Path Validation Security Hardening

[raamana]

This PR adds comprehensive path validation to prevent path traversal attacks and unauthorized access to system directories. All user-provided file paths in CLI commands are now validated before use.

Security Improvements

Path Traversal Prevention

• Blocks relative paths containing .. (parent directory traversal)
• Validates and resolves all paths before file operations
• Prevents access to files outside intended directories

System Directory Protection

• Blocks writes to critical system directories (/etc, /System, C:\Windows, etc.)
• Platform-specific protection for Linux, macOS, and Windows
• Allows legitimate temp directories (e.g., /tmp, /private/var/folders on macOS)

User Permission Warnings

• Detects when running as administrator/root
• Warns users about security risks of elevated privileges
• Recommends running as non-admin user

Changes

New Files

• cdisc_rules_engine/utilities/path_validator.py - Core path validation logic
• cdisc_rules_engine/exceptions/path_validation_exceptions.py - Custom exceptions for path validation errors
• tests/unit/test_utilities/test_path_validator.py - Comprehensive unit tests (18 tests)
• tests/unit/test_core_path_validation.py - CLI integration tests (8 tests)

Modified Files

• core.py - Integrated path validation for all CLI commands:
  • validate command: validates output, cache, data, dataset, define-xml, and dictionary paths
  • update_cache command: validates cache, custom rules, and custom standard paths
  • Refactored dictionary path handling to use dictionary directly (removed if/elif chain)
• cdisc_rules_engine/exceptions/__init__.py - Exported new path validation exceptions

Path Validation Coverage

The following user-provided paths are now validated:

validate command:

• --output / -o - Output file path (write operation)
• --cache / -c - Cache directory path
• --data / -d - Data directory path (read)
• --dataset-path / -dp - Dataset file paths (read)
• --define-xml-path / -dxp - Define-XML file path (read)
• --report-template / -rt - Report template path (read)
• --whodrug, --meddra, --loinc, --medrt, --unii - Dictionary paths (read)

update_cache command:

• --cache-path / -c - Cache directory path
• --custom-rules-directory / -crd - Custom rules directory (read)
• --custom-rule / -cr - Custom rule files (read)
• --update-custom-rule / -ucr - Custom rule update file (read)
• --custom-standard / -cs - Custom standard JSON file (read)

Testing

• 18 path validator unit tests
• 8 CLI integration tests

Code Quality Improvements

• Refactored dictionary path handling in core.py to eliminate repetitive if/elif chain
• Improved maintainability by using dictionary directly for validation and construction
• Added comprehensive error messages for invalid paths

NOTE: AI was used in helping expedite the process of improving code and docs

[SFJohnson24]

hi @raamana -- it looks like a few of our unit tests are failing with the new logic from your PR.
FAILED tests/unit/test_usdm_data.py::TestListDatasetMetadata::test_list_dataset_metadata_with_valid_paths - AssertionError: 1 != 0
FAILED tests/unit/test_operations/test_define_variable_metadata.py::test_get_define_variable_metadata_variable_in_domain[PandasDataset] - FileNotFoundError: [Errno 2] No such file or directory
FAILED tests/unit/test_operations/test_define_variable_metadata.py::test_get_define_variable_metadata_variable_in_domain[DaskDataset] - FileNotFoundError: [Errno 2] No such file or directory
FAILED tests/unit/test_operations/test_define_variable_metadata.py::test_get_define_variable_metadata_variable_not_in_domain[PandasDataset] - FileNotFoundError: [Errno 2] No such file or directory
FAILED tests/unit/test_operations/test_define_variable_metadata.py::test_get_define_variable_metadata_variable_not_in_domain[DaskDataset] - FileNotFoundError: [Errno 2] No such file or directory
FAILED tests/unit/test_services/test_data_service/test_local_data_service.py::test_get_variables_metdata[PandasDataset] - FileNotFoundError: [Errno 2] No such file or directory
The logs can be found here: https://github.com/cdisc-org/cdisc-rules-engine/actions/runs/20857758163/job/59943489801?pr=1500 -- could you take a look and resolve them?