45 lines
1.5 KiB
Python
45 lines
1.5 KiB
Python
"""Path-component helpers shared by execution environment backends.
|
|
|
|
Kept separate from the base environment class so lazy backend imports do not
|
|
depend on newly added exports from a large module cached earlier in a long-lived
|
|
process.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import hashlib
|
|
import re
|
|
|
|
|
|
# A persistent sandbox's host directory is named after task_id, and that name
|
|
# then becomes the source half of a Docker bind spec or a writable Singularity
|
|
# overlay directory. Keep every backend on one collision-safe mapping.
|
|
_SANDBOX_DIR_UNSAFE_RE = re.compile(r"[^A-Za-z0-9._-]")
|
|
_SANDBOX_DIR_MAX_LEN = 128
|
|
_SANDBOX_DIR_HASH_LEN = 12
|
|
|
|
|
|
def sanitize_task_id_for_path(task_id: str) -> str:
|
|
"""Return a bind-mountable directory name for *task_id*'s sandbox.
|
|
|
|
Names that are already safe are returned verbatim, preserving existing
|
|
sandbox locations. Rewritten names carry a digest because substitution
|
|
alone is not injective: ``a:b`` and ``a_b`` must not share state.
|
|
"""
|
|
value = task_id if isinstance(task_id, str) else ""
|
|
if not value:
|
|
return "default"
|
|
|
|
cleaned = _SANDBOX_DIR_UNSAFE_RE.sub("_", value)
|
|
if (
|
|
cleaned == value
|
|
and len(value) <= _SANDBOX_DIR_MAX_LEN
|
|
and value not in {".", ".."}
|
|
and not value.endswith((".", " "))
|
|
):
|
|
return value
|
|
|
|
digest = hashlib.sha256(value.encode("utf-8")).hexdigest()[:_SANDBOX_DIR_HASH_LEN]
|
|
stem = cleaned[: _SANDBOX_DIR_MAX_LEN - _SANDBOX_DIR_HASH_LEN - 1].strip("._")
|
|
return f"{stem or 'task'}-{digest}"
|