fix(utils): explain CWD / ROBOVERSE_DATA_DIR mismatches in hf_util instead of reporting traversal - #36
Open
geng-haoran wants to merge 1 commit into
Open
fix(utils): explain CWD / ROBOVERSE_DATA_DIR mismatches in hf_util instead of reporting traversal#36geng-haoran wants to merge 1 commit into
geng-haoran wants to merge 1 commit into
Conversation
…stead of reporting traversal A roboverse_data/... asset path evaluated from a working directory that is not the parent of ROBOVERSE_DATA_DIR was rejected as a path-traversal attempt. The error now names the working directory, the configured LOCAL_DIR and, when the asset already exists there, its location, and explains that ROBOVERSE_DATA_DIR only changes where downloads are stored. The falls_back_to_private test pins LOCAL_DIR so it no longer depends on the caller's environment. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017i6VtKoovBNed815mWFqxw
geng-haoran
force-pushed
the
fix/hf-util-relative-paths
branch
from
September 3, 2026 04:59
0958e5f to
88b29f4
Compare
geng-haoran
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Asset paths in configs are
roboverse_data/...and are opened by the backends relative to the current working directory;ROBOVERSE_DATA_DIRonly changes wherehf_utildownloads land. When the two disagree (running from a worktree or another directory withROBOVERSE_DATA_DIRset),check_and_download_singlecomputed a..relpath and rejected the asset as a path-traversal attempt — an error that sends people looking for a malformed descriptor instead of the real cause.roboverse_data/...path from a genuine escape and explains the CWD /ROBOVERSE_DATA_DIRmismatch, names the working directory andLOCAL_DIR, points at the asset when it already exists there, and suggests running from the repo root or symlinking./roboverse_data...guard is unchanged.test_check_and_download_single_falls_back_to_private_roboverse_datapinsLOCAL_DIRto the CWD default so it no longer fails whenever the caller hasROBOVERSE_DATA_DIRset (it did here).Tests
metasim/test/test_hf_util.py,metasim/test/test_hf_util_local_dir.py(+1 regression test for the mismatch message): 22 passed.Not changed
The underlying design issue —
ROBOVERSE_DATA_DIRnot being honoured by the backends when they open the files — is out of scope; this PR makes the failure explain itself.🤖 Generated with Claude Code
https://claude.ai/code/session_017i6VtKoovBNed815mWFqxw