From 8e30ad68c9f1b0607650647d6ae253e526bbd992 Mon Sep 17 00:00:00 2001 From: Mads Hvelplund Date: Fri, 19 Jun 2026 06:54:00 +0200 Subject: [PATCH] fix: reject empty --mount paths An empty or whitespace-only --mount value resolves to the current working directory and would silently bind-mount it into the sandbox. Reject it. --- strix/interface/utils.py | 5 ++++- tests/test_local_sources.py | 8 ++++++++ 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/strix/interface/utils.py b/strix/interface/utils.py index dfe2f4ec..da1c7081 100644 --- a/strix/interface/utils.py +++ b/strix/interface/utils.py @@ -1262,10 +1262,13 @@ def build_mount_targets_info(mount_paths: list[str]) -> list[dict[str, Any]]: Each path must be an existing local directory; it is bind-mounted into the sandbox (read-only) instead of being copied file-by-file. Raises - ``ValueError`` for a path that does not exist or is not a directory. + ``ValueError`` for an empty path, or one that does not exist or is not a + directory. """ targets_info: list[dict[str, Any]] = [] for raw in mount_paths: + if not raw or not raw.strip(): + raise ValueError("--mount path must not be empty.") path = Path(raw).expanduser() try: resolved = path.resolve() diff --git a/tests/test_local_sources.py b/tests/test_local_sources.py index af6e5a17..4f7f600e 100644 --- a/tests/test_local_sources.py +++ b/tests/test_local_sources.py @@ -114,3 +114,11 @@ def test_build_mount_targets_info_rejects_file(tmp_path: Path) -> None: _write_file(file_path, 10) with pytest.raises(ValueError, match="not an existing directory"): build_mount_targets_info([str(file_path)]) + + +@pytest.mark.parametrize("empty", ["", " "]) +def test_build_mount_targets_info_rejects_empty_path(empty: str) -> None: + # An empty path would otherwise resolve to the current working directory + # and silently bind-mount it into the sandbox. + with pytest.raises(ValueError, match="must not be empty"): + build_mount_targets_info([empty])