Removing the additional duplicate sub-directory from sanitize_path()

The existing implementation adds an additional sub-directory with the same name when an image is pulled and is stored explicitly to a custom output directory. This happens because the "test_path" variable appends "path" to "base_dir" wherein the "path" variable itself is base_dir + filename. This commit fixes this problem.

Signed-off-by: saketjajoo <[email protected]>

oras/tests/test_provider.py

@@ -12,6 +12,8 @@
 import oras.provider
 import oras.utils
 
+from pathlib import Path
+
 here = os.path.abspath(os.path.dirname(__file__))
 
 registry_host = os.environ.get("ORAS_HOST")
@@ -116,3 +118,14 @@ def test_parse_manifest():
     ref, content_type = remote._parse_manifest_ref(testref)
     assert ref == "path/to/config.json"
     assert content_type == oras.defaults.unknown_config_media_type
+
+
+def test_sanitize_path():
+    HOME_DIR = str(Path.home())
+    assert str(oras.utils.sanitize_path(HOME_DIR, HOME_DIR)) == f"{HOME_DIR}"
+    assert str(oras.utils.sanitize_path(HOME_DIR, os.path.join(HOME_DIR, "username"))) == f"{HOME_DIR}/username"
+    assert str(oras.utils.sanitize_path(HOME_DIR, os.path.join(HOME_DIR, ".", "username"))) == f"{HOME_DIR}/username"
+
+    with pytest.raises(Exception) as e:
+        assert oras.utils.sanitize_path(HOME_DIR, os.path.join(HOME_DIR, ".."))
+    assert str(e.value) == f"Filename {Path(os.path.join(HOME_DIR, '..')).resolve()} is not in {HOME_DIR} directory"

oras/utils/fileio.py

@@ -15,6 +15,7 @@
 import tarfile
 import tempfile
 from contextlib import contextmanager
+from os.path import expanduser
 from typing import Generator, Optional, TextIO, Union
 
 
@@ -43,15 +44,11 @@ def sanitize_path(expected_dir, path):
     It can be directly there or a child, but not outside it.
     We raise an error if it does not - this should not happen
     """
-    # It's OK to pull to PWD exactly
-    if os.path.abspath(expected_dir) == os.path.abspath(path):
-        return os.path.abspath(expected_dir)
-    base_dir = pathlib.Path(expected_dir)
-    test_path = (base_dir / path).resolve()
-    if not base_dir.resolve() in test_path.resolve().parents:
-        raise Exception(f"Filename {test_path} is not in {base_dir} directory")
-    return str(test_path.resolve())
-
+    base_dir = pathlib.Path(expected_dir).expanduser().resolve()
+    path = pathlib.Path(path).expanduser().resolve() # path = base_dir + file_name
+    if not ((base_dir in path.parents) or (str(base_dir) == str(path))):
+        raise Exception(f"Filename {path} is not in {base_dir} directory")
+    return str(path)
 
 @contextmanager
 def workdir(dirname):