fix: address review comments (iteration #1)

Author: aviruthen

sagemaker-core/src/sagemaker/core/common_utils.py

@@ -1689,7 +1689,10 @@ def _is_bad_path(path, base):
     """
     # joinpath will ignore base if path is absolute
     resolved = _get_resolved_path(joinpath(base, path))
-    return os.path.commonpath([resolved, base]) != base
+    try:
+        return os.path.commonpath([resolved, base]) != base
+    except ValueError:
+        return True  # If we can't determine safety, treat as bad path
 
 
 def _is_bad_link(info, base):

sagemaker-core/src/sagemaker/core/utils/__init__.py

@@ -19,6 +19,9 @@
 """
 from __future__ import absolute_import
 
+# Public API surface: only non-private functions are exported via __all__.
+# Private helpers (_get_resolved_path, _is_bad_path, _is_bad_link, _get_safe_members)
+# are still importable directly but are not part of the public API.
 __all__ = [
     "_save_model",
     "download_file_from_url",
@@ -36,6 +39,10 @@
     "sagemaker_timestamp",
     "sagemaker_short_timestamp",
     "get_config_value",
+]
+
+# Internal helpers that are importable but not part of the public API
+_INTERNAL_NAMES = [
     "_get_resolved_path",
     "_is_bad_path",
     "_is_bad_link",
@@ -45,7 +52,7 @@
 
 def __getattr__(name):
     """Lazy import to avoid circular dependencies."""
-    if name in __all__:
+    if name in __all__ or name in _INTERNAL_NAMES:
         from sagemaker.core import common_utils
 
         return getattr(common_utils, name)