Prevent artifact storage path escapes from reserved dataset names

[fallintoplace]

Summary

• reject . and .. for artifact directory names
• resolve artifact subpaths against the artifact root and fail if they escape it
• add storage and interface regression coverage for reserved dataset names

Why

ArtifactStorage previously joined artifact_path and dataset_name directly. In resume flows, dataset_name=".." could resolve outside the artifact root, and dataset_name="." could collapse the dataset directory onto the artifact root.

Testing

• uv run --package data-designer-engine pytest packages/data-designer-engine/tests/engine/storage/test_artifact_storage.py
• uv run --package data-designer pytest packages/data-designer/tests/interface/test_data_designer.py -k reserved_dataset_name
• uv run ruff check packages/data-designer-engine/src/data_designer/engine/storage/artifact_storage.py packages/data-designer-engine/tests/engine/storage/test_artifact_storage.py packages/data-designer/tests/interface/test_data_designer.py
• uv run ruff format --check packages/data-designer-engine/src/data_designer/engine/storage/artifact_storage.py packages/data-designer-engine/tests/engine/storage/test_artifact_storage.py packages/data-designer/tests/interface/test_data_designer.py

[github-actions]

Linked Issue Check

This PR does not reference an issue. External contributions must link to
a triaged issue before the PR can be merged.

Add one of the following to your PR description:

• Fixes #<issue-number>
• Closes #<issue-number>
• Resolves #<issue-number>

If no issue exists yet, open one
and a maintainer will triage it.

See CONTRIBUTING.md
for details.

[github-actions]

All contributors have signed the DCO ✍️ ✅
_{Posted by the DCO Assistant Lite bot.}

[greptile-apps]

Greptile Summary

This PR closes a path-traversal hole in ArtifactStorage where passing dataset_name=".." in a resume flow could cause the engine to read or write outside the designated artifact root. The fix adds two complementary defenses: an explicit reject of "." and ".." in the model validator, and a _resolve_artifact_subpath helper that uses Path.resolve() plus relative_to() as a belt-and-suspenders check on every derived storage path.

• Validation guard — validate_folder_names now rejects "." and ".." for all five configurable folder name fields before any path construction occurs.
• Runtime path guard — _resolve_artifact_subpath resolves the candidate path against resolved_artifact_path (a new cached property) and raises ArtifactStorageError if the result escapes the artifact root, protecting against any future bypass of the validator.
• Test coverage — new parametrized unit tests cover all five fields for both reserved names, a cache-injection test exercises the runtime guard independently, and an integration test confirms DataDesigner.create() surfaces the error end-to-end.

Confidence Score: 5/5

The change adds purely additive validation with no modifications to existing logic paths; all new error paths raise immediately without side effects.

Both the validator-level and runtime-level guards are correct, the Path.resolve() + relative_to() pattern is the standard way to prevent directory traversal in Python, and the test suite covers the direct validation path, the cache-injection bypass scenario, and the full integration path through DataDesigner.create().

No files require special attention.

Important Files Changed

Filename	Overview
packages/data-designer-engine/src/data_designer/engine/storage/artifact_storage.py	Adds path-traversal defenses: a '.' / '..' reject in the model validator, a new resolved_artifact_path cached_property, and a _resolve_artifact_subpath helper that uses Path.resolve() + relative_to() as a belt-and-suspenders check on every derived path.
packages/data-designer-engine/tests/engine/storage/test_artifact_storage.py	Adds parametrized coverage for all five folder-name fields rejecting '.' and '..', plus a test that directly injects '..' into the resolved_dataset_name cache to verify the belt-and-suspenders check in _resolve_artifact_subpath.
packages/data-designer/tests/interface/test_data_designer.py	Adds an integration-level regression test verifying that DataDesigner.create() propagates the ArtifactStorageError when dataset_name='..' is passed.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["ArtifactStorage init"] --> B["validate_artifact_path\nmust be existing dir"]
    B --> C["validate_folder_names"]
    C --> D["Check each folder name"]
    D -->|"empty"| E["ArtifactStorageError"]
    D -->|"duplicate"| F["ArtifactStorageError"]
    D -->|"invalid chars"| G["ArtifactStorageError"]
    D -->|"dot or dotdot"| H["ArtifactStorageError"]
    D -->|"passes"| I["Init MediaStorage via base_dataset_path"]
    I --> J["_resolve_artifact_subpath"]
    J --> K["resolved_artifact_path.joinpath parts .resolve"]
    K --> L{"relative_to check"}
    L -->|"fails"| M["ArtifactStorageError escapes root"]
    L -->|"passes"| N["Return resolved Path"]
    N --> O["ArtifactStorage ready"]

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A["ArtifactStorage init"] --> B["validate_artifact_path\nmust be existing dir"]
    B --> C["validate_folder_names"]
    C --> D["Check each folder name"]
    D -->|"empty"| E["ArtifactStorageError"]
    D -->|"duplicate"| F["ArtifactStorageError"]
    D -->|"invalid chars"| G["ArtifactStorageError"]
    D -->|"dot or dotdot"| H["ArtifactStorageError"]
    D -->|"passes"| I["Init MediaStorage via base_dataset_path"]
    I --> J["_resolve_artifact_subpath"]
    J --> K["resolved_artifact_path.joinpath parts .resolve"]
    K --> L{"relative_to check"}
    L -->|"fails"| M["ArtifactStorageError escapes root"]
    L -->|"passes"| N["Return resolved Path"]
    N --> O["ArtifactStorage ready"]

Loading

_{Reviews (1): Last reviewed commit: "Prevent artifact path escapes from datas..." | Re-trigger Greptile}

[fallintoplace]

I have read the DCO document and I hereby sign the DCO.

[github-actions]

Stale PR reminder

This PR has had failing checks for 7 days without activity.

Failing checks: semantic-pull-request / semantic-pull-request, DCOAssistant, check

Please push an update or leave a comment if you're still working on this.
Otherwise, this PR will be automatically closed in 7 days.

To prevent auto-close, add the keep-open label.

[nabinchha]

Thanks for the contribution and for thinking about artifact-path safety. After reviewing this, we don’t believe the scenario warrants additional handling right now. It requires explicitly using . or .. as a dataset name—and path escape additionally depends on resume behavior—which isn’t a realistic supported workflow.

The broader containment logic also adds complexity and changes existing filesystem behavior without a reported user case. We’re going to close this PR for now, but we can revisit a narrower validation change if this surfaces in a real workflow. Thanks again!