jkomyno fe7a28ce87 fix(core): reject unsafe mount paths in RemoteFile.save() in both SDKs ...

Port safe_basename to the TypeScript SDK and route the default-path branch
of RemoteFile.save() through it, so a mountRelativePath of "", ".", "sub/.",
"foo/.." or ".." throws a ValidationError before any mkdir or write instead
of an unhandled EISDIR. RemoteFile.filename now splits on both separators.

Fix the shared check order in Python's safe_basename: the usability check
ran on the raw segment while the stripped value was written, so a name such
as " . " reached the filesystem as "." and failed with
IsADirectoryError.

Claude-Session: https://claude.ai/code/session_015Wv6TtPJ5GoHj9oE8FoyUc

2026-09-15 00:28:36 +02:00

..

fixtures

fix(sdk): preserve primitive JSON Schema semantics (#4316)

2026-09-04 14:19:02 +02:00

__init__.py

…

conftest.py

refactor(python): consolidate path construction from untrusted input (#4144)

2026-08-18 13:07:07 +02:00

test_auth_configs.py

fix(py): cursorbot

2026-02-06 02:08:50 +04:00

test_auto_upload_download_files.py

fix(python): preserve nullable file upload arguments

2026-08-25 04:09:41 +02:00

test_connected_accounts.py

fix(connected-accounts-py): address review feedback on #3412

2026-05-13 18:22:07 +05:30

test_core_types.py

Fix typedocs and examples for toolkit version (#2212)

2025-12-04 16:03:23 +05:30

test_crewai_provider.py

fix(python): dereference $ref/$defs in Google provider (#4297)

2026-09-07 16:00:20 +02:00

test_cross_sdk_compatibility.py

fix(json-schema): accept and preserve dynamic object content across converters

2026-08-06 20:33:53 +05:30

test_custom_tools.py

fix(py): keep local results when remote multi-execute transport fails (#4386)

2026-09-08 18:11:25 +02:00

test_file_upload_robustness.py

fix(sdk): pin the validated address when fetching URLs (SSRF DNS rebinding) (#4172)

2026-08-20 13:34:37 +02:00

test_files.py

fix(sdk): preserve primitive JSON Schema semantics (#4316)

2026-09-04 14:19:02 +02:00

test_gemini_provider.py

fix(sdk): preserve primitive JSON Schema semantics (#4316)

2026-09-04 14:19:02 +02:00

test_generate_docs.py

fix(py): normalize generated SDK doc examples (#3689)

2026-06-26 15:12:15 +04:00

test_google_provider.py

fix(python): dereference $ref/$defs in Google provider (#4297)

2026-09-07 16:00:20 +02:00

test_home_guard.py

refactor(python): consolidate path construction from untrusted input (#4144)

2026-08-18 13:07:07 +02:00

test_imports.py

feat(py): remove legacy custom tools (#3508)

2026-06-04 23:53:26 -07:00

test_json_schema.py

fix(py): resolve $ref/$defs so file flags behind a reference aren't dropped (#3653)

2026-06-25 00:53:50 +04:00

test_lazy_cache_directory.py

fix(python): create the cache directory on first use instead of at import time (#4162)

2026-08-18 15:45:52 +02:00

test_logging_redaction.py

fix(sdk): keep credentials private in storage and logs (#4318)

2026-09-03 01:45:11 +02:00

test_mimetypes.py

Fix .jpg resolving to non-standard image/jpg instead of image/jpeg (#4333)

2026-09-03 12:27:09 +02:00

test_no_retry_writes.py

fix(py): normalize toolkit-less tool metadata (#4178)

2026-08-20 15:00:47 +02:00

test_normalize_tool_arguments.py

fix(providers): normalize string tool-call arguments across all providers (TS + Python) (#3514)

2026-06-16 12:49:37 +04:00

test_openapi.py

fix(py): handle list-valued JSON Schema type in openapi signatures (#3822)

2026-07-15 23:34:26 +04:00

test_path_join_guardrail.py

fix(python): create the cache directory on first use instead of at import time (#4162)

2026-08-18 15:45:52 +02:00

test_provider_argument_serialization.py

refactor(python): consolidate path construction from untrusted input (#4144)

2026-08-18 13:07:07 +02:00

test_provider_ref_contract.py

fix(python): dereference $ref/$defs in Google provider (#4297)

2026-09-07 16:00:20 +02:00

test_provider.py

test(py): preserve isolated Autogen regression coverage

2026-08-26 19:40:26 +02:00

test_pydantic_utils.py

test: add unit tests for pydantic utils (none_to_omit, parse_pydantic_error) (#3784)

2026-07-28 13:05:51 +05:30

test_redaction.py

fix(sdk): keep credentials private in storage and logs (#4318)

2026-09-03 01:45:11 +02:00

test_safe_path.py

fix(core): reject unsafe mount paths in RemoteFile.save() in both SDKs

2026-09-15 00:28:36 +02:00

test_schema_composition_parity.py

fix(sdk): preserve primitive JSON Schema semantics (#4316)

2026-09-04 14:19:02 +02:00

test_schema_converter.py

fix(py): preserve nested provider argument presence

2026-08-10 22:14:21 +02:00

test_schema_parser.py

fix(sdk): preserve primitive JSON Schema semantics (#4316)

2026-09-04 14:19:02 +02:00

test_schema_primitive_parity.py

fix(sdk): preserve primitive JSON Schema semantics (#4316)

2026-09-04 14:19:02 +02:00

test_schema_property_semantics.py

fix(sdk): preserve primitive JSON Schema semantics (#4316)

2026-09-04 14:19:02 +02:00

test_schema_semantic_regressions.py

fix(sdk): preserve primitive JSON Schema semantics (#4316)

2026-09-04 14:19:02 +02:00

test_sdk.py

fix(python-sdk): isolate default provider per Composio instance (#4370)

2026-09-08 13:33:10 +02:00

test_sensitive_file_upload_paths.py

fix(python): block sensitive paths hidden by symlinks

2026-08-25 20:49:04 +02:00

test_strict_schema_corpus.py

test(json-schema): drive strict-mode cases from a shared corpus

2026-08-26 17:37:53 +02:00

test_strict_schema.py

fix(python): preserve explicit empty tool schemas

2026-08-27 15:38:27 +02:00

test_tool_execution.py

fix(python): preserve nullable file upload arguments

2026-08-25 04:09:41 +02:00

test_tool_retrieval_errors.py

fix(core): raise tool not found only on 404/400

2026-09-11 22:54:53 +02:00

test_tool_router_session_files.py

fix(core): reject unsafe mount paths in RemoteFile.save() in both SDKs

2026-09-15 00:28:36 +02:00

test_tool_router.py

feat(py): add tool router session deletion

2026-06-28 22:59:25 +04:00

test_tool_schema_aliasing.py

fix(sdk): route provider tool calls through sessions (#4098)

2026-08-18 23:55:11 +02:00

test_toolkit_version.py

fix(sdk): resolve toolkit versions case-insensitively in both SDKs (#3762)

2026-07-06 15:30:06 +04:00

test_triggers.py

fix(sdk): harden pusher auth and cross-origin redirect headers (#4406)

2026-09-09 21:29:18 +02:00

test_type_inference_anthropic.py

feat(py): support type-safe generic get_tools() based on given provider (#2469)

2026-02-09 15:55:51 +05:30

test_type_inference_autogen.py

feat(py): support type-safe generic get_tools() based on given provider (#2469)

2026-02-09 15:55:51 +05:30

test_type_inference_claude_agent_sdk.py

feat(py): support type-safe generic get_tools() based on given provider (#2469)

2026-02-09 15:55:51 +05:30

test_type_inference_crewai.py

feat(py): support type-safe generic get_tools() based on given provider (#2469)

2026-02-09 15:55:51 +05:30

test_type_inference_custom_provider.py

feat(py): support type-safe generic get_tools() based on given provider (#2469)

2026-02-09 15:55:51 +05:30

test_type_inference_gemini.py

feat(py): support type-safe generic get_tools() based on given provider (#2469)

2026-02-09 15:55:51 +05:30

test_type_inference_google_adk.py

feat(py): support type-safe generic get_tools() based on given provider (#2469)

2026-02-09 15:55:51 +05:30

test_type_inference_google.py

feat(py): support type-safe generic get_tools() based on given provider (#2469)

2026-02-09 15:55:51 +05:30

test_type_inference_langchain.py

feat(py): support type-safe generic get_tools() based on given provider (#2469)

2026-02-09 15:55:51 +05:30

test_type_inference_langgraph.py

feat(py): support type-safe generic get_tools() based on given provider (#2469)

2026-02-09 15:55:51 +05:30

test_type_inference_llamaindex.py

feat(py): support type-safe generic get_tools() based on given provider (#2469)

2026-02-09 15:55:51 +05:30

test_type_inference_openai_agents.py

feat(py): support type-safe generic get_tools() based on given provider (#2469)

2026-02-09 15:55:51 +05:30

test_type_inference.py

feat(py): support type-safe generic get_tools() based on given provider (#2469)

2026-02-09 15:55:51 +05:30

test_upload_dir_allowlist.py

fix(py): send Content-Type on S3 PUTs and parse Content-Length (#4168)

2026-08-18 19:09:02 +02:00

test_url_safety_pinning.py

fix(sdk): pin the validated address when fetching URLs (SSRF DNS rebinding) (#4172)

2026-08-20 13:34:37 +02:00

test_url_safety.py

fix(sdk): harden pusher auth and cross-origin redirect headers (#4406)

2026-09-09 21:29:18 +02:00

test_verify_webhook_integration.py

feat(py): add tests for cross-sdk webhook handling parity between Python and TypeScriptSDK

2026-01-29 18:20:07 +04:00

test_webhook_events.py

fix(py): address python comments

2026-02-06 20:32:18 +04:00