security(ocr): run OCR container as non-root user (CIS Docker §4.1) #611
@@ -24,7 +24,7 @@ log = logging.getLogger(__name__)
|
||||
BLLA_MODEL_PATH = os.environ.get("BLLA_MODEL_PATH", "/app/models/blla.mlmodel")
|
||||
# DOI for "General segmentation model for print and handwriting" — ketos 7 compatible.
|
||||
BLLA_MODEL_DOI = "10.5281/zenodo.14602569"
|
||||
HTRMOPO_DIR = os.path.expanduser("~/.local/share/htrmopo")
|
||||
HTRMOPO_DIR = os.environ.get("HTRMOPO_DIR", "/app/models/.htrmopo")
|
||||
|
||||
|
||||
def _model_is_loadable(path: str) -> bool:
|
||||
|
||||
@@ -1,10 +1,35 @@
|
||||
"""Unit tests for ensure_blla_model.main()."""
|
||||
|
||||
import importlib
|
||||
import os
|
||||
from unittest.mock import MagicMock, call, patch
|
||||
|
||||
import ensure_blla_model
|
||||
|
||||
|
||||
# ─── HTRMOPO_DIR env var resolution ──────────────────────────────────────────
|
||||
|
||||
|
||||
def test_htrmopo_dir_reads_from_env_var():
|
||||
"""HTRMOPO_DIR uses the HTRMOPO_DIR env var when set, not ~ expansion."""
|
||||
with patch.dict(os.environ, {"HTRMOPO_DIR": "/custom/htrmopo"}):
|
||||
importlib.reload(ensure_blla_model)
|
||||
result = ensure_blla_model.HTRMOPO_DIR
|
||||
importlib.reload(ensure_blla_model)
|
||||
assert result == "/custom/htrmopo"
|
||||
|
||||
|
||||
def test_htrmopo_dir_default_is_fixed_path():
|
||||
"""Default HTRMOPO_DIR is a fixed path not derived from ~ (no-create-home safe)."""
|
||||
clean_env = {k: v for k, v in os.environ.items() if k != "HTRMOPO_DIR"}
|
||||
with patch.dict(os.environ, clean_env, clear=True):
|
||||
importlib.reload(ensure_blla_model)
|
||||
result = ensure_blla_model.HTRMOPO_DIR
|
||||
importlib.reload(ensure_blla_model)
|
||||
assert "~" not in result
|
||||
assert not result.startswith("/.")
|
||||
|
||||
|
||||
# ─── Model already loadable ───────────────────────────────────────────────────
|
||||
|
||||
|
||||
|
||||
Reference in New Issue
Block a user