Private
Public Access
refactor(mcp_client): migrate L171 _is_allowed to Path.is_relative_to (Phase 8 site 1)
The legacy code used 'try: rp.relative_to(cwd); return True; except ValueError: pass' to check path containment. Python 3.9+ has Path.is_relative_to() which returns bool directly, eliminating the silent-swallow try/except entirely. This is a NON-SLIMING migration: the function's behavior is unchanged (still returns True/False), the test of path containment is the same, but the implementation no longer relies on bare except+pass. No logging added, no silenced error, just a cleaner API. Audit: mcp_client INTERNAL_SILENT_SWALLOW 3 -> 2.
This commit is contained in:
+2
-8
@@ -165,17 +165,11 @@ def _is_allowed(path: Path) -> bool:
|
|||||||
# Allow current working directory and subpaths by default if no base_dirs
|
# Allow current working directory and subpaths by default if no base_dirs
|
||||||
cwd = Path.cwd().resolve()
|
cwd = Path.cwd().resolve()
|
||||||
if not _base_dirs:
|
if not _base_dirs:
|
||||||
try:
|
if rp.is_relative_to(cwd):
|
||||||
rp.relative_to(cwd)
|
|
||||||
return True
|
return True
|
||||||
except ValueError:
|
|
||||||
pass
|
|
||||||
for bd in _base_dirs:
|
for bd in _base_dirs:
|
||||||
try:
|
if rp.is_relative_to(bd):
|
||||||
rp.relative_to(bd)
|
|
||||||
return True
|
return True
|
||||||
except ValueError:
|
|
||||||
continue
|
|
||||||
return False
|
return False
|
||||||
|
|
||||||
def _resolve_and_check(raw_path: str) -> tuple[Path | None, str]:
|
def _resolve_and_check(raw_path: str) -> tuple[Path | None, str]:
|
||||||
|
|||||||
Reference in New Issue
Block a user