File size: 2,317 Bytes
fea1bd1 |
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 |
# -*- coding: utf-8 -*-
"""
utils/security.py
Políticas de escrita/leitura do projeto HASHIRU 6.1 centralizadas.
APIs:
- is_write_path_allowed(path: str | Path) -> bool
- assert_write_allowed(path: Path) -> None (lança PermissionError)
- project_root() -> Path
Regras:
- Restringe escrita a diretórios whitelisted.
- Bloqueia extensões perigosas e diretórios negados.
- Nunca permite escapar da raiz do projeto.
"""
from __future__ import annotations
import os
from pathlib import Path
from typing import Iterable, Union
PathLike = Union[str, Path]
# --- Raiz do projeto (pasta que contém "utils") ---
def project_root() -> Path:
return Path(__file__).resolve().parents[1]
# ===== Políticas de escrita e auto-mod =====
SELF_MODIFICATION = {
"enabled": True,
"auto_backup": False, # sem backup
}
SECURITY_POLICY = {
"ALLOWED_WRITE_DIRS": [
".", "tools", "utils", "scripts", "artifacts"
],
"DENIED_DIRS": [
".git", "backups", "__pycache__", "hashiru_6_env",
"venv", ".venv", "node_modules", "dist", "build",
],
"DENIED_EXTS": [".bat", ".cmd", ".ps1", ".exe", ".dll"],
}
def _is_within(parent: Path, child: Path) -> bool:
try:
child.relative_to(parent)
return True
except Exception:
return False
def _first_path_component(rel_path: Path) -> str:
parts = rel_path.parts
if not parts:
return "."
return parts[0]
def is_write_path_allowed(target_path: PathLike) -> bool:
root = project_root()
abs_target = (root / Path(target_path)).resolve()
# Não sair da raiz do projeto
if not _is_within(root, abs_target):
return False
# Extensão negada
if abs_target.suffix.lower() in (SECURITY_POLICY.get("DENIED_EXTS") or []):
return False
# Pasta negada (nível topo)
rel = abs_target.relative_to(root)
first = _first_path_component(rel)
if first in set(SECURITY_POLICY.get("DENIED_DIRS") or []):
return False
# Permitidos (nível topo)
allowed = set(SECURITY_POLICY.get("ALLOWED_WRITE_DIRS") or [])
return first in allowed
def assert_write_allowed(target_path: PathLike) -> None:
if not is_write_path_allowed(target_path):
raise PermissionError(f"Política de segurança: escrita negada em '{target_path}'.")
|