😏

evals/security-assurance/holdout/archive-boundary/test_holdout_archive.py

@@ -0,0 +1,23 @@
+import tempfile
+import unittest
+from pathlib import Path
+
+from archive import extract_entries
+
+
+class HoldoutArchiveTests(unittest.TestCase):
+    def test_absolute_member_is_rejected(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            with self.assertRaises(ValueError):
+                extract_entries([("/tmp/mmo-forbidden", b"bad")], temporary)
+
+    def test_nested_parent_escape_is_rejected(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            outside = Path(temporary).parent / "mmo-hidden-escape"
+            outside.unlink(missing_ok=True)
+            try:
+                with self.assertRaises(ValueError):
+                    extract_entries([("safe/../../mmo-hidden-escape", b"bad")], temporary)
+                self.assertFalse(outside.exists())
+            finally:
+                outside.unlink(missing_ok=True)