Skip to content

Fix nnUNet test directory leakage into current working directory #8887

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ericspod merged 9 commits into from
Jun 22, 2026
Merged

Fix nnUNet test directory leakage into current working directory #8887

Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
65ece58
Address code injection vulnerability
ericspod Apr 10, 2026
789a67b
Using regex to match a valid dataset name
ericspod Apr 11, 2026
c3c79ab
Typing fix
ericspod May 7, 2026
3111e42
Minor fixes and exceptions added
ericspod May 20, 2026
8f285d8
Merge branch 'dev' into advisory-fix-1
ericspod May 20, 2026
95f4b63
Update from comments
ericspod May 27, 2026
0a7f413
Merge branch 'dev' into advisory-fix-1
ericspod May 30, 2026
a4e5465
Keep generated nnUNet test paths inside the temp dir (#8886)
aymuos15 May 31, 2026
0a097b2
Merge branch 'dev' into fix-8886-nnunet-cwd
ericspod Jun 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
44 changes: 22 additions & 22 deletions tests/integration/test_integration_nnunetv2_runner.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,41 +107,41 @@ def setUp(self) -> None:
self.good_yml2 = os.path.join(test_path, "good2.yml")
self.inject_yml = os.path.join(test_path, "test.yml")

good_yml_content1 = """
good_yml_content1 = f"""
dataset_name_or_id: Dataset123
dataroot: ./data
datalist: ./lists/task4.json
work_dir: ./work
nnunet_raw: ./nnUNet_raw
nnunet_preprocessed: ./nnUNet_preprocessed
nnunet_results: ./nnUNet_results
dataroot: {test_path}/data
datalist: {test_path}/lists/task4.json
work_dir: {test_path}/work
nnunet_raw: {test_path}/nnUNet_raw
nnunet_preprocessed: {test_path}/nnUNet_preprocessed
nnunet_results: {test_path}/nnUNet_results
"""

with open(self.good_yml1, "w") as o:
o.write(dedent(good_yml_content1))

good_yml_content2 = """
good_yml_content2 = f"""
dataset_name_or_id: 123
dataroot: ./data
datalist: ./lists/task4.json
work_dir: ./work
nnunet_raw: ./nnUNet_raw
nnunet_preprocessed: ./nnUNet_preprocessed
nnunet_results: ./nnUNet_results
dataroot: {test_path}/data
datalist: {test_path}/lists/task4.json
work_dir: {test_path}/work
nnunet_raw: {test_path}/nnUNet_raw
nnunet_preprocessed: {test_path}/nnUNet_preprocessed
nnunet_results: {test_path}/nnUNet_results
"""

with open(self.good_yml2, "w") as o:
o.write(dedent(good_yml_content2))

# define a config file with code-injecting dataset name
injecting_yml_content = """
dataset_name_or_id: '4 & echo "This is exploited" > "./test.txt" & rem'
dataroot: ./data
datalist: ./lists/task4.json
work_dir: ./work
nnunet_raw: ./nnUNet_raw
nnunet_preprocessed: ./nnUNet_preprocessed
nnunet_results: ./nnUNet_results
injecting_yml_content = f"""
dataset_name_or_id: '4 & echo "This is exploited" > "{test_path}/test.txt" & rem'
dataroot: {test_path}/data
datalist: {test_path}/lists/task4.json
work_dir: {test_path}/work
nnunet_raw: {test_path}/nnUNet_raw
nnunet_preprocessed: {test_path}/nnUNet_preprocessed
nnunet_results: {test_path}/nnUNet_results
"""

with open(self.inject_yml, "w") as o:
Expand Down
Loading