python: reject a bare str or bytes in identify_paths (#1472)

python/src/magika/magika.py

@@ -168,7 +168,10 @@ def identify_paths(
         self, paths: Sequence[Union[str, os.PathLike[str]]]
     ) -> List[MagikaResult]:
         """Identify the content type of a list of files given their paths."""
-        if not isinstance(paths, Sequence):
+        # Note: `str` and `bytes` are registered as `Sequence`, but iterating
+        # them yields their elements, not paths; accepting them here would
+        # silently return one result per character instead of raising.
+        if isinstance(paths, (str, bytes)) or not isinstance(paths, Sequence):
             raise TypeError("Input paths should be of type Sequence[Path]")
 
         paths_ = []

python/tests/test_magika_python_module.py

@@ -443,6 +443,15 @@ def test_api_call_with_bad_types() -> None:
     _ = m.identify_paths(["/non_existing.txt", "/not_existing2.txt"])
     with pytest.raises(TypeError):
         _ = m.identify_paths(Path("/non_existing.txt"))  # ty: ignore[invalid-argument-type]
+    # A bare `str`/`bytes` is a `Sequence`, but it is not a sequence of paths:
+    # iterating it yields its elements, so it must be rejected rather than
+    # returning one result per character. Note that a bare `str` type-checks
+    # against `Sequence[Union[str, os.PathLike]]`, so only the runtime check
+    # can catch it.
+    with pytest.raises(TypeError):
+        _ = m.identify_paths("/non_existing.txt")
+    with pytest.raises(TypeError):
+        _ = m.identify_paths(b"/non_existing.txt")  # ty: ignore[invalid-argument-type]
     with pytest.raises(TypeError):
         _ = m.identify_paths([b"/non_existing.txt"])  # ty: ignore[invalid-argument-type]
     with pytest.raises(TypeError):