vh/booth
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(blur): writes are strict, so a set the writer cannot read is never overwritten

Browse Source 
groa's late retry on the blur bug-hunt, adjudicated against the landed code.
Its four bugs were already fixed, but a robustness note (mkstemp's 0600 locks
out a reader under another uid, which then "sees nothing and replaces it")
pointed at a real gap. set_blurred built on read_blurred, the renderer's
lenient reader, which turns an unreadable, oversized or malformed
`.blurred.json` into an empty set. The writer then replaced the file, and
whatever it held was gone. This is the `.marks.json` wipe of 2026-09-21 in a
new module, and it shipped for a night.

- `_load` is the one parse with two postures. read_blurred maps its refusal to
  "nothing blurred" (a damaged file costs the blur, never the page).
  set_blurred lets it raise BlurUnwritable, which the route answers with 409
  and the CLI with exit 3, and changes nothing.
- It refuses only for a REGULAR file it cannot read. A link, a directory or a
  FIFO at either name holds no set anyone wrote, so it reads as empty, and the
  postcondition judges whether the write can land: a link is replaced, a
  directory refused.
- The file is 0644 again, as the line-format writer left it (fchmod after
  mkstemp).

The open flags in `_read_capped` became a second layer behind the new lstat
check, and the mutation run caught their rows VACUOUS through the public API.
They are now held to account by direct tests, because they still close the
lstat-to-open race. blur_storage.toml: 25/25. No second panel was run: this
folds one reviewer note plus the repo's own recorded lesson, with a test and
a proved row for each behaviour.
This commit is contained in:
vh
2026-09-24 00:56:25 -07:00
parent 7d4a26f486
commit 8a78a9bd1d
5 changed files with 220 additions and 57 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/mutations/blur_storage.toml
+72 -24
View File
@@ -33,29 +33,29 @@ label = "a JSON-only reader: every live line-format file un-blurs on deploy"
file = "booth/blur.py"
test = "tests/test_blur.py::test_the_legacy_line_format_still_reads"
old = '''
return {ln.strip() for ln in text.splitlines() if ln.strip()}'''
return {ln.strip() for ln in text.splitlines() if ln.strip()}'''
new = '''
return set()'''
return set()'''
[[mutation]]
label = "a legacy file that is not JSON reads as nothing instead of falling back"
file = "booth/blur.py"
test = "tests/test_blur.py::test_a_legacy_rel_that_starts_with_a_bracket_still_reads"
old = '''
text = raw.decode("utf-8", "surrogateescape")
return {ln.strip()'''
if path is legacy:
return {ln.strip()'''
new = '''
text = raw.decode("utf-8", "surrogateescape")
try:
json.loads(text)
except ValueError:
return set()
return {ln.strip()'''
if path is legacy:
try:
json.loads(text)
except ValueError:
return set()
return {ln.strip()'''
[[mutation]]
label = "a FIFO blocks the read (no O_NONBLOCK)"
file = "booth/blur.py"
test = "tests/test_blur.py::test_a_fifo_blur_file_does_not_block_the_read"
test = "tests/test_blur.py::test_the_raw_read_never_blocks_on_a_fifo"
old = '''
fd = os.open(path, os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK)'''
new = '''
@@ -64,7 +64,7 @@ new = '''
[[mutation]]
label = "the read follows a planted symlink (no O_NOFOLLOW)"
file = "booth/blur.py"
test = "tests/test_blur.py::test_a_symlinked_blur_file_is_not_followed_on_read"
test = "tests/test_blur.py::test_the_raw_read_never_follows_a_link"
old = '''
fd = os.open(path, os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK)'''
new = '''
@@ -134,17 +134,17 @@ label = "the legacy file is sniffed for JSON again (a `[\"a.png\"]` line blurs t
file = "booth/blur.py"
test = "tests/test_blur.py::test_a_legacy_line_that_is_valid_json_still_reads_as_a_line"
old = '''
text = raw.decode("utf-8", "surrogateescape")
return {ln.strip()'''
if path is legacy:
return {ln.strip()'''
new = '''
text = raw.decode("utf-8", "surrogateescape")
try:
d = json.loads(text)
if isinstance(d, list):
return {r for r in d if isinstance(r, str)}
except ValueError:
pass
return {ln.strip()'''
if path is legacy:
try:
d = json.loads(text)
if isinstance(d, list):
return {r for r in d if isinstance(r, str)}
except ValueError:
pass
return {ln.strip()'''
[[mutation]]
label = "no postcondition: a planted directory's OSError is swallowed as success"
@@ -169,9 +169,9 @@ label = "a lone surrogate from a planted file reaches the writer"
file = "booth/blur.py"
test = "tests/test_blur.py::test_a_lone_surrogate_in_the_file_is_skipped_and_writes_still_work"
old = '''
return {r for r in data if isinstance(r, str) and r and _encodable(r)}'''
return {r for r in data if isinstance(r, str) and r and _encodable(r)}'''
new = '''
return {r for r in data if isinstance(r, str) and r}'''
return {r for r in data if isinstance(r, str) and r}'''
[[mutation]]
label = "the writer writes a set the reader would refuse and read as nothing"
@@ -210,3 +210,51 @@ except ImportError as exc:
new = '''
except ZeroDivisionError as exc:
src = os.environ["BOOTH_SRC"]'''
# ---- reads lenient, writes strict (groa's retry; the .marks.json lesson) -------
[[mutation]]
label = "the writer builds on the lenient reader (an unreadable set is overwritten)"
file = "booth/blur.py"
test = "tests/test_blur.py::test_an_unreadable_blur_file_is_never_overwritten"
old = '''
current = _load(booth)'''
new = '''
current = read_blurred(booth)'''
[[mutation]]
label = "an unreadable or oversized regular file reads as empty for the writer"
file = "booth/blur.py"
test = "tests/test_blur.py::test_an_oversized_blur_file_is_never_overwritten"
old = '''
raise BlurUnwritable(f"{path.name} in {booth.name!r} is not a readable file of sane size")'''
new = '''
return set()'''
[[mutation]]
label = "a malformed set reads as empty for the writer"
file = "booth/blur.py"
test = "tests/test_blur.py::test_a_malformed_blur_file_is_never_overwritten"
old = '''
raise BlurUnwritable(f"{BLUR_FILE} in {booth.name!r} is not JSON") from exc'''
new = '''
return set()'''
[[mutation]]
label = "the set is written 0600 (mkstemp's default)"
file = "booth/blur.py"
test = "tests/test_blur.py::test_the_blur_file_is_world_readable_as_it_always_was"
old = '''
os.fchmod(fd, 0o644)'''
new = '''
pass'''
[[mutation]]
label = "a link or a FIFO at the name blocks the writer instead of reading as no set"
file = "booth/blur.py"
test = "tests/test_blur.py::test_a_write_replaces_a_planted_symlink_rather_than_writing_through_it"
old = '''
if not stat.S_ISREG(st.st_mode):
return set()'''
new = '''
pass'''
tests/test_blur.py
+69 -1
View File
@@ -266,7 +266,8 @@ def test_a_planted_directory_at_the_blur_file_is_a_refusal_not_a_crash(tmp_path)
def test_unblurring_under_a_planted_directory_is_not_an_error(tmp_path):
"""Nothing reads as blurred and nothing was asked to be: the reader agrees
with the request, so there is nothing to refuse."""
with the request, so there is nothing to refuse. A directory holds no set,
so strict writes (below) have nothing to protect here."""
(tmp_path / BLUR_FILE).mkdir()
assert set_blurred(tmp_path, "a.png", False) == set()
@@ -375,3 +376,70 @@ def test_the_cli_fails_closed_without_its_package(tmp_path):
def test_a_fifo_at_the_legacy_name_does_not_block_the_read(tmp_path):
os.mkfifo(tmp_path / LEGACY_BLUR_FILE)
assert _within(5, lambda: read_blurred(tmp_path)) == set()
# ---- reads lenient, writes strict (groa's retry, and marks' lesson) ------------
#
# The reader turns anything it cannot read into an EMPTY set, which is right for
# rendering: a damaged file costs the blur, never the page. A writer that builds
# on that empty set then replaces the file, and whatever it could not read is
# gone. That is the `.marks.json` wipe of 2026-09-21
# (persistent-memory.d/2026-09-21-marks-write-wiped-judgment.md), and a
# cross-uid reader that got EACCES would do it here (groa).
def test_an_unreadable_blur_file_is_never_overwritten(tmp_path):
"""Defeating change: set_blurred building on the lenient reader."""
set_blurred(tmp_path, "a.png", True)
before = (tmp_path / BLUR_FILE).read_bytes()
os.chmod(tmp_path / BLUR_FILE, 0)
try:
with pytest.raises(BlurUnwritable):
set_blurred(tmp_path, "b.png", True)
finally:
os.chmod(tmp_path / BLUR_FILE, 0o644)
assert (tmp_path / BLUR_FILE).read_bytes() == before
def test_a_malformed_blur_file_is_never_overwritten(tmp_path):
(tmp_path / BLUR_FILE).write_text("not json at all")
with pytest.raises(BlurUnwritable):
set_blurred(tmp_path, "a.png", True)
assert (tmp_path / BLUR_FILE).read_text() == "not json at all"
def test_an_oversized_blur_file_is_never_overwritten(tmp_path, monkeypatch):
import booth.blur as blur
set_blurred(tmp_path, "a.png", True)
before = (tmp_path / BLUR_FILE).read_bytes()
monkeypatch.setattr(blur, "BLUR_MAX_BYTES", 4)
with pytest.raises(BlurUnwritable):
set_blurred(tmp_path, "b.png", False)
assert (tmp_path / BLUR_FILE).read_bytes() == before
def test_the_blur_file_is_world_readable_as_it_always_was(tmp_path):
"""groa: mkstemp creates 0600, where the line-format writer left 0644, so a
reader under another uid saw nothing. Defeating change: no chmod."""
set_blurred(tmp_path, "a.png", True)
assert (tmp_path / BLUR_FILE).stat().st_mode & 0o777 == 0o644
# The open flags are the SECOND layer: `_load` lstat-checks for a regular file
# first, so a FIFO or a link never reaches `os.open` through the public API, and
# a mutation run found the flags VACUOUS there. They still close the race (a
# file swapped for a FIFO or a link between the lstat and the open), so they
# are held to account directly, where nothing stands in front of them.
def test_the_raw_read_never_blocks_on_a_fifo(tmp_path):
from booth.blur import _read_capped
os.mkfifo(tmp_path / "f")
assert _within(5, lambda: _read_capped(tmp_path / "f")) is None
def test_the_raw_read_never_follows_a_link(tmp_path):
from booth.blur import _read_capped
(tmp_path / "real.json").write_text('["a.png"]')
(tmp_path / "link").symlink_to(tmp_path / "real.json")
assert _read_capped(tmp_path / "link") is None