Merge branch 'main' into copilot/standardize-deprecation-calls

Author: romanlutz

doc/code/memory/embeddings.ipynb

@@ -77,7 +77,7 @@
     }
    ],
    "source": [
-    "embedding_response.to_json()"
+    "embedding_response.model_dump_json()"
    ]
   },
   {

doc/code/memory/embeddings.py

@@ -40,7 +40,7 @@
 # To view the json of an embedding
 
 # %%
-embedding_response.to_json()
+embedding_response.model_dump_json()
 
 # %% [markdown]
 # To save an embedding to disk

doc/scanner/0_scanner.md

@@ -32,7 +32,7 @@ PyRIT ships with scenarios organized into the following families:
 
 | Family | Scenarios | Documentation |
 |--------|-----------|---------------|
-| **AIRT** | ContentHarms, Psychosocial, Cyber, Jailbreak, Leakage, Scam | [AIRT Scenarios](airt.ipynb) |
+| **AIRT** | RapidResponse, Psychosocial, Cyber, Jailbreak, Leakage, Scam | [AIRT Scenarios](airt.ipynb) |
 | **Benchmark** | AdversarialBenchmark | [Benchmark Scenarios](benchmark.ipynb) |
 | **Foundry** | RedTeamAgent | [Foundry Scenarios](foundry.ipynb) |
 | **Garak** | Encoding | [Garak Scenarios](garak.ipynb) |

pyrit/backend/mappers/attack_mappers.py

@@ -13,10 +13,10 @@
 
 import logging
 import mimetypes
-import os
 import time
 import uuid
 from datetime import datetime, timedelta, timezone
+from pathlib import Path
 from typing import TYPE_CHECKING, Optional, cast
 from urllib.parse import quote, urlparse
 
@@ -178,7 +178,7 @@ def _resolve_media_url(*, value: Optional[str], data_type: str) -> Optional[str]
     if value.startswith(("http://", "https://", "data:")):
         return value
     # Local file path — construct a media endpoint URL
-    if os.path.isfile(value):
+    if Path(value).is_file():
         return f"/api/media?path={quote(str(value))}"
     return value
 
@@ -373,7 +373,7 @@ def _build_filename(
         source = value
         if source.startswith("http"):
             source = urlparse(source).path
-        ext = os.path.splitext(source)[1]  # e.g. ".png"
+        ext = Path(source).suffix  # e.g. ".png"
 
     if not ext:
         # Fallback: guess from mime type based on data type prefix

pyrit/backend/routes/media.py

@@ -12,7 +12,6 @@
 
 import logging
 import mimetypes
-import os
 from pathlib import Path
 
 from fastapi import APIRouter, HTTPException, Query
@@ -61,39 +60,40 @@
 }
 
 
-def _validate_media_path(*, path: str, allowed_root: str) -> str:
+def _validate_media_path(*, path: str, allowed_root: Path) -> Path:
     """
     Validate and sanitize a user-provided file path against an allowed root directory.
 
-    Uses ``os.path.realpath`` to resolve symlinks and ``..`` components, then
-    verifies the canonical path starts with the allowed root prefix. This is
-    the standard sanitization pattern recognized by static analysis tools
-    (e.g. CodeQL ``py/path-injection``).
+    Uses ``Path.resolve()`` to resolve symlinks and ``..`` components, then
+    verifies the canonical path is under the allowed root. This is the standard
+    sanitization pattern recognized by static analysis tools (e.g. CodeQL
+    ``py/path-injection``).
 
     Args:
         path: The user-provided file path to validate.
-        allowed_root: The canonical (``realpath``-resolved) allowed root directory.
+        allowed_root: The canonical (``resolve``-d) allowed root directory.
 
     Returns:
         The canonical, validated file path.
 
     Raises:
         HTTPException 403: If the path fails any validation check.
     """
-    real_path = os.path.realpath(path)
-    allowed_prefix = allowed_root + os.sep
+    real_path = Path(path).resolve(strict=False)
 
-    if not real_path.startswith(allowed_prefix):
-        raise HTTPException(status_code=403, detail="Access denied: path is outside the allowed results directory.")
+    try:
+        relative_parts = real_path.relative_to(allowed_root).parts
+    except ValueError as exc:
+        raise HTTPException(
+            status_code=403, detail="Access denied: path is outside the allowed results directory."
+        ) from exc
 
     # Restrict to known media subdirectories (e.g. prompt-memory-entries/)
-    relative_parts = Path(os.path.relpath(real_path, allowed_root)).parts
     if not relative_parts or relative_parts[0] not in _ALLOWED_SUBDIRECTORIES:
         raise HTTPException(status_code=403, detail="Access denied: path is not in a media subdirectory.")
 
     # Only allow known media file extensions
-    _, ext = os.path.splitext(real_path)
-    if ext.lower() not in _ALLOWED_EXTENSIONS:
+    if real_path.suffix.lower() not in _ALLOWED_EXTENSIONS:
         raise HTTPException(status_code=403, detail="Access denied: file type is not allowed.")
 
     return real_path
@@ -125,13 +125,13 @@ async def serve_media_async(
         memory = CentralMemory.get_memory_instance()
         if not memory.results_path:
             raise HTTPException(status_code=500, detail="Memory results_path is not configured.")
-        allowed_root = os.path.realpath(memory.results_path)
+        allowed_root = Path(memory.results_path).resolve(strict=False)
     except Exception as exc:
         raise HTTPException(status_code=500, detail="Memory not initialized; cannot determine results path.") from exc
 
     validated_path = _validate_media_path(path=path, allowed_root=allowed_root)
 
-    if not os.path.isfile(validated_path):
+    if not validated_path.is_file():
         raise HTTPException(status_code=404, detail="File not found.")
 
     mime_type, _ = mimetypes.guess_type(validated_path)

pyrit/memory/azure_sql_memory.py

@@ -354,7 +354,7 @@ def _get_condition_json_property_match(
             json_column (InstrumentedAttribute[Any]): The JSON-backed model field to query.
             property_path (str): The JSON path for the property to match.
             value (str): The string value that must match the extracted JSON property value.
-            partial_match (bool): Whether to perform a substring match.
+            partial_match (bool): Whether to perform a substring match. Defaults to False.
             case_sensitive (bool): Whether the match should be case-sensitive. Defaults to False.
 
         Returns:

pyrit/memory/memory_interface.py

@@ -197,7 +197,7 @@ def _get_condition_json_match(
                 and the condition should resolve if any element in that array matches the value.
                 Cannot be used with partial_match.
             value (str): The string value that must match the extracted JSON property value.
-            partial_match (bool): Whether to perform a substring match.
+            partial_match (bool): Whether to perform a substring match. Defaults to False.
             case_sensitive (bool): Whether the match should be case-sensitive. Defaults to False.
 
         Returns:
@@ -238,11 +238,16 @@ def _get_condition_json_property_match(
         """
         Return a database-specific condition for matching a value at a given path within a JSON object.
 
+        Concrete subclasses translate this contract into their SQL dialect (e.g. SQLite's
+        ``json_extract``, Azure SQL's ``JSON_VALUE`` + ``ISJSON``). Implementations must honor
+        ``partial_match`` and ``case_sensitive`` identically so callers can rely on consistent
+        matching semantics across backends.
+
         Args:
             json_column (InstrumentedAttribute[Any]): The JSON-backed model field to query.
             property_path (str): The JSON path for the property to match.
             value (str): The string value that must match the extracted JSON property value.
-            partial_match (bool): Whether to perform a substring match.
+            partial_match (bool): Whether to perform a substring match. Defaults to False.
             case_sensitive (bool): Whether the match should be case-sensitive. Defaults to False.
 
         Returns:
@@ -262,6 +267,11 @@ def _get_condition_json_array_match(
         """
         Return a database-specific condition for matching an array at a given path within a JSON object.
 
+        Concrete subclasses translate this contract into their SQL dialect (e.g. SQLite's
+        ``json_each`` + ``json_extract``, Azure SQL's ``OPENJSON`` + ``JSON_QUERY``).
+        Implementations must honor ``match_mode`` and the empty-``array_to_match`` "absence"
+        semantics identically so callers can rely on consistent matching across backends.
+
         Args:
             json_column (InstrumentedAttribute[Any]): The JSON-backed SQLAlchemy field to query.
             property_path (str): The JSON path for the target array.

pyrit/memory/sqlite_memory.py

@@ -220,7 +220,7 @@ def _get_condition_json_property_match(
             json_column (InstrumentedAttribute[Any]): The JSON-backed model field to query.
             property_path (str): The JSON path for the property to match.
             value (str): The string value that must match the extracted JSON property value.
-            partial_match (bool): Whether to perform a substring match.
+            partial_match (bool): Whether to perform a substring match. Defaults to False.
             case_sensitive (bool): Whether the match should be case-sensitive. Defaults to False.
 
         Returns:

pyrit/models/chat_message.py

@@ -35,30 +35,37 @@ class ChatMessage(BaseModel):
     tool_calls: Optional[list[ToolCall]] = None
     tool_call_id: Optional[str] = None
 
-    def to_json(self) -> str:
+    def to_dict(self) -> dict[str, Any]:
         """
-        Serialize the ChatMessage to a JSON string.
+        Convert the ChatMessage to a dictionary.
 
         Returns:
-            A JSON string representation of the message.
+            A dictionary representation of the message, excluding None values.
 
         """
-        return self.model_dump_json()
+        return self.model_dump(exclude_none=True)
 
-    def to_dict(self) -> dict[str, Any]:
+    def to_json(self) -> str:
         """
-        Convert the ChatMessage to a dictionary.
+        Serialize the ChatMessage to a JSON string (deprecated, use ``model_dump_json`` instead).
 
         Returns:
-            A dictionary representation of the message, excluding None values.
+            A JSON string representation of the message.
 
         """
-        return self.model_dump(exclude_none=True)
+        from pyrit.common.deprecation import print_deprecation_message
+
+        print_deprecation_message(
+            old_item="ChatMessage.to_json",
+            new_item="ChatMessage.model_dump_json",
+            removed_in="0.15.0",
+        )
+        return self.model_dump_json()
 
     @classmethod
     def from_json(cls, json_str: str) -> "ChatMessage":
         """
-        Deserialize a ChatMessage from a JSON string.
+        Deserialize a ChatMessage from a JSON string (deprecated, use ``model_validate_json`` instead).
 
         Args:
             json_str: A JSON string representation of a ChatMessage.
@@ -67,6 +74,13 @@ def from_json(cls, json_str: str) -> "ChatMessage":
             A ChatMessage instance.
 
         """
+        from pyrit.common.deprecation import print_deprecation_message
+
+        print_deprecation_message(
+            old_item="ChatMessage.from_json",
+            new_item="ChatMessage.model_validate_json",
+            removed_in="0.15.0",
+        )
         return cls.model_validate_json(json_str)
 
 

pyrit/models/embeddings.py

@@ -70,12 +70,19 @@ def load_from_file(file_path: Path) -> EmbeddingResponse:
 
     def to_json(self) -> str:
         """
-        Serialize this embedding response to JSON.
+        Serialize this embedding response to JSON (deprecated, use ``model_dump_json`` instead).
 
         Returns:
             str: JSON-encoded embedding response.
 
         """
+        from pyrit.common.deprecation import print_deprecation_message
+
+        print_deprecation_message(
+            old_item="EmbeddingResponse.to_json",
+            new_item="EmbeddingResponse.model_dump_json",
+            removed_in="0.15.0",
+        )
         return self.model_dump_json()