Merge upstream/dev

Author: Sahil-u07

abort_rebase.py

@@ -0,0 +1,12 @@
+import subprocess
+import os
+
+os.chdir(r'C:\Users\Sahil\concore')
+
+# Abort rebase
+subprocess.run(['git', 'rebase', '--abort'], capture_output=True)
+
+# Check status
+result = subprocess.run(['git', 'status'], capture_output=True, text=True)
+print(result.stdout)
+print(result.stderr)

complete_push.py

@@ -0,0 +1,61 @@
+import subprocess
+import sys
+import os
+
+os.chdir(r'C:\Users\Sahil\concore')
+
+print("Aborting rebase and recovering branch state...")
+
+# Method 1: Direct HEAD manipulation
+with open('.git/HEAD', 'w') as f:
+    f.write('ref: refs/heads/feature/enhanced-workflow-validation\n')
+
+# Remove rebase state
+import shutil
+try:
+    shutil.rmtree('.git/rebase-merge')
+    print("✓ Removed rebase-merge directory")
+except:
+    pass
+
+try:
+    os.remove('.git/REBASE_HEAD')
+    print("✓ Removed REBASE_HEAD")
+except:
+    pass
+
+# Reset to original HEAD
+result = subprocess.run(['git', 'reset', '--hard', 'ad0f393'], capture_output=True, text=True)
+print(result.stdout)
+if result.stderr:
+    print(result.stderr)
+
+# Check status
+result = subprocess.run(['git', 'status', '--short'], capture_output=True, text=True)
+print("\nCurrent status:")
+print(result.stdout)
+
+# Fetch upstream
+print("\nFetching upstream...")
+result = subprocess.run(['git', 'fetch', 'upstream'], capture_output=True, text=True)
+if result.returncode != 0:
+    print(result.stderr)
+
+# Merge upstream/dev
+print("\nMerging upstream/dev...")
+result = subprocess.run(['git', 'merge', 'upstream/dev', '-m', 'Merge upstream/dev'], capture_output=True, text=True)
+print(result.stdout)
+if result.returncode != 0:
+    print("Merge conflicts or error:")
+    print(result.stderr)
+    sys.exit(1)
+
+# Push
+print("\nPushing to origin...")
+result = subprocess.run(['git', 'push', 'origin', 'feature/enhanced-workflow-validation', '--force-with-lease'], capture_output=True, text=True)
+print(result.stdout)
+if result.returncode != 0:
+    print(result.stderr)
+    sys.exit(1)
+
+print("\n✓ Successfully pushed!")

concore_cli/cli.py

@@ -47,16 +47,13 @@ def run(workflow_file, source, output, type, auto_build):
 
 @cli.command()
 @click.argument('workflow_file', type=click.Path(exists=True))
-@click.option(
-    '--source',
-    '-s',
-    type=click.Path(exists=True, file_okay=False, dir_okay=True, path_type=Path),
-    help='Source directory to check file references',
-)
+@click.option('--source', '-s', default='src', help='Source directory')
 def validate(workflow_file, source):
     """Validate a workflow file"""
     try:
-        validate_workflow(workflow_file, console, source)
+        ok = validate_workflow(workflow_file, source, console)
+        if not ok:
+            sys.exit(1)
     except Exception as e:
         console.print(f"[red]Error:[/red] {str(e)}")
         sys.exit(1)

concore_cli/commands/validate.py

@@ -5,8 +5,9 @@
 import re
 import xml.etree.ElementTree as ET
 
-def validate_workflow(workflow_file, console, source_dir=None):
+def validate_workflow(workflow_file, source_dir, console):
     workflow_path = Path(workflow_file)
+    source_root = (workflow_path.parent / source_dir)
 
     console.print(f"[cyan]Validating:[/cyan] {workflow_path.name}")
     console.print()
@@ -15,31 +16,35 @@ def validate_workflow(workflow_file, console, source_dir=None):
     warnings = []
     info = []
 
+    def finalize():
+        show_results(console, errors, warnings, info)
+        return len(errors) == 0
+    
     try:
         with open(workflow_path, 'r') as f:
             content = f.read()
 
         if not content.strip():
             errors.append("File is empty")
-            return show_results(console, errors, warnings, info)
+            return finalize()
 
         # strict XML syntax check
         try:
             ET.fromstring(content)
         except ET.ParseError as e:
             errors.append(f"Invalid XML: {str(e)}")
-            return show_results(console, errors, warnings, info)
+            return finalize()
 
         try:
             soup = BeautifulSoup(content, 'xml')
         except Exception as e:
             errors.append(f"Invalid XML: {str(e)}")
-            return show_results(console, errors, warnings, info)
+            return finalize()
 
         root = soup.find('graphml')
         if not root:
             errors.append("Not a valid GraphML file - missing <graphml> root element")
-            return show_results(console, errors, warnings, info)
+            return finalize()
 
         # check the graph attributes
         graph = soup.find('graph')
@@ -65,6 +70,9 @@ def validate_workflow(workflow_file, console, source_dir=None):
         else:
             info.append(f"Found {len(edges)} edge(s)")
 
+        if not source_root.exists():
+            warnings.append(f"Source directory not found: {source_root}")
+        
         node_labels = []
         for node in nodes:
             #check the node id
@@ -84,6 +92,11 @@ def validate_workflow(workflow_file, console, source_dir=None):
                     label = label_tag.text.strip()
                     node_labels.append(label)
 
+                    # reject shell metacharacters to prevent command injection (#251)
+                    if re.search(r'[;&|`$\'"()\\]', label):
+                        errors.append(f"Node '{label}' contains unsafe shell characters")
+                        continue
+                    
                     if ':' not in label:
                         warnings.append(f"Node '{label}' missing format 'ID:filename'")
                     else:
@@ -96,6 +109,10 @@ def validate_workflow(workflow_file, console, source_dir=None):
                                 errors.append(f"Node '{label}' has no filename")
                             elif not any(filename.endswith(ext) for ext in ['.py', '.cpp', '.m', '.v', '.java']):
                                 warnings.append(f"Node '{label}' has unusual file extension")
+                            elif source_root.exists():
+                                file_path = source_root / filename
+                                if not file_path.exists():
+                                    errors.append(f"Missing source file: {filename}")
                 else:
                     warnings.append(f"Node {node_id} has no label")
             except Exception as e:
@@ -138,44 +155,17 @@ def validate_workflow(workflow_file, console, source_dir=None):
         if file_edges > 0:
             info.append(f"File-based edges: {file_edges}")
 
-        if source_dir:
-            _check_source_files(soup, Path(source_dir), errors, warnings)
-        
         _check_cycles(soup, errors, warnings)
         _check_zmq_ports(soup, errors, warnings)
 
-        show_results(console, errors, warnings, info)
+        return finalize()
 
     except FileNotFoundError:
         console.print(f"[red]Error:[/red] File not found: {workflow_path}")
+        return False
     except Exception as e:
         console.print(f"[red]Validation failed:[/red] {str(e)}")
-
-def _check_source_files(soup, source_path, errors, warnings):
-    nodes = soup.find_all('node')
-    
-    for node in nodes:
-        label_tag = node.find('y:NodeLabel') or node.find('NodeLabel')
-        if not label_tag or not label_tag.text:
-            continue
-            
-        label = label_tag.text.strip()
-        if ':' not in label:
-            warnings.append(f"Skipping node with invalid label format (expected 'ID:filename')")
-            continue
-            
-        parts = label.split(':')
-        if len(parts) != 2:
-            warnings.append(f"Skipping node '{label}' with invalid format")
-            continue
-            
-        _, filename = parts
-        if not filename:
-            continue
-        
-        file_path = source_path / filename
-        if not file_path.exists():
-            errors.append(f"Source file not found: {filename}")
+        return False
 
 def _check_cycles(soup, errors, warnings):
     nodes = soup.find_all('node')

fix_and_push.bat

@@ -0,0 +1,8 @@
+@echo off
+cd C:\Users\Sahil\concore
+rmdir /s /q .git\rebase-merge 2>nul
+del /f .git\REBASE_HEAD 2>nul
+git reset --hard ad0f393
+git fetch upstream
+git merge upstream/dev -m "Merge upstream/dev"
+git push origin feature/enhanced-workflow-validation --force-with-lease

mkconcore.py

@@ -101,6 +101,25 @@ def safe_path(value, context):
         raise ValueError(f"Unsafe {context}: '{value}' contains illegal characters.")
     return value
 
+def safe_relpath(value, context):
+    """
+    Allow relative subpaths while blocking traversal and absolute/drive paths.
+    Used for node source file paths that may contain subdirectories.
+    """
+    if not value:
+        raise ValueError(f"{context} cannot be empty")
+    normalized = value.replace("\\", "/")
+    safe_path(normalized, context)
+    if normalized.startswith("/") or normalized.startswith("~"):
+        raise ValueError(f"Unsafe {context}: absolute paths are not allowed.")
+    if re.match(r"^[A-Za-z]:", normalized):
+        raise ValueError(f"Unsafe {context}: drive paths are not allowed.")
+    if ":" in normalized:
+        raise ValueError(f"Unsafe {context}: ':' is not allowed in relative paths.")
+    if any(part in ("", "..") for part in normalized.split("/")):
+        raise ValueError(f"Unsafe {context}: invalid path segment.")
+    return normalized
+
 MKCONCORE_VER = "22-09-18"
 
 SCRIPT_DIR = os.path.dirname(os.path.abspath(__file__))
@@ -251,7 +270,8 @@ def _resolve_concore_path():
                 if ':' in node_label:
                     container_part, source_part = node_label.split(':', 1)
                     safe_name(container_part, f"Node container name '{container_part}'")
-                    safe_name(source_part, f"Node source file '{source_part}'")
+                    source_part = safe_relpath(source_part, f"Node source file '{source_part}'")
+                    node_label = f"{container_part}:{source_part}"
                 else:
                     safe_name(node_label, f"Node label '{node_label}'")
                     # Explicitly reject incorrect format to prevent later crashes and ambiguity
@@ -447,6 +467,9 @@ def _resolve_concore_path():
         dockername, langext = sourcecode, ""
 
     script_target_path = os.path.join(outdir, "src", sourcecode)
+    script_target_parent = os.path.dirname(script_target_path)
+    if script_target_parent:
+        os.makedirs(script_target_parent, exist_ok=True)
 
     # If the script was specialized, it's already in outdir/src. If not, copy from sourcedir.
     if node_id_key not in node_edge_params:

tests/test_graph.py

@@ -163,7 +163,7 @@ def test_validate_missing_source_file(self):
         result = self.runner.invoke(cli, ['validate', filepath, '--source', str(source_dir)])
 
         self.assertIn('Validation failed', result.output)
-        self.assertIn('Source file not found: missing.py', result.output)
+        self.assertIn('Missing source file', result.output)
 
     def test_validate_with_existing_source_file(self):
         content = '''