Skip to content

python: reject a bare str or bytes in identify_paths (#1472) - #1476

Open
kaluli123123 wants to merge 3 commits into
google:mainfrom
kaluli123123:fix/identify-paths-reject-str
Open

kaluli123123 wants to merge 3 commits into
google:mainfrom
kaluli123123:fix/identify-paths-reject-str

Conversation

@kaluli123123

@kaluli123123 kaluli123123 commented Sep 14, 2026 •

Copy link
Copy Markdown

Fixes #1472.

Rejects bare str/bytes in identify_paths() while preserving valid path sequences and identify_path(str). Merged main at 8d3d3b9 without expanding the fix.

Python 3.13 validation: focused regression passed; non-slow suite 40 passed / 1 skipped; lock, Ruff, formatting, mypy, copyright and real path-input/CLI/module smokes passed.

The broader unchanged Rust baseline hit a macOS FFI dynamic-linker error; this is not a full Rust-suite pass. Current-head CI and formal maintainer approval remain required.

`str` and `bytes` are registered as `collections.abc.Sequence`, so the
container guard in `identify_paths()` let them through. The string was then
iterated character by character and the call returned one bogus
`MagikaResult` per character instead of raising `TypeError` — including a
`Status.OK` `directory` result for the `.` component.

Exclude `str`/`bytes` from the guard, which is the only place this can be
caught: a bare `str` type-checks fine against
`Sequence[Union[str, os.PathLike]]`.

Fixes google#1472
@ebursztein

Copy link
Copy Markdown
Collaborator

Thank you! I checked this against the current main (Python on the Rust library): it still merges cleanly, the bug still reproduces without it, and the full Python suite passes with it, including your new test. It's listed in #1537 as ready to merge.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

python: identify_paths() silently accepts a bare str and returns one bogus result per character

2 participants