peter
4bae9113e4
Review round 1: the two existing safe_abs_path escape tests both pass even against the classic buggy `str(path).startswith(str(root))` containment check, so a regression to that bug would have shipped green. Add the one input that distinguishes the correct `root not in path.parents` guard: a sibling dir whose name prefixes the root (/root vs /rootx). Mutation-verified — swapping the guard to startswith now fails this test. Also corrected the requirements-dev header (installed by Dockerfile.test, not a nonexistent `dev` stage).
8 lines
508 B
Plaintext
8 lines
508 B
Plaintext
# Test + lint tooling — NEVER in the prod image. Installed only by backend/Dockerfile.test (the
|
|
# throwaway test image), which the prod build (root Dockerfile) never references. Pinned so the
|
|
# suite is reproducible: pytest for the pure-logic tests, and ruff at the SAME version the gate's
|
|
# backend lint lane currently runs on the host (see the run_lint note in siftlode.sh). httpx is
|
|
# already an app dependency (requirements.txt), so its TestClient needs nothing extra here.
|
|
pytest==8.4.2
|
|
ruff==0.15.21
|