Repository navigation
[BUG] DBFS and Files reject every path with a relative data directory #43
Description
Description
The default ./data configuration makes DBFS and Files operations fail with Invalid path, including ordinary uploads. Workspace operations use a different, correct root resolution.
Reproduced on MiniLake 1.9.0, commit fe8837dcfac9df621dfabc440abc07ebb4cdbcbb, using the repository's Docker test image, a real HTTP server, and fresh disposable state. Image Python sources were verified byte-for-byte against this commit. No mocks or production data were used.
Affected Components
- src/minilake/services/dbfs.py —
_resolve - src/minilake/services/files.py —
_resolve - src/minilake/config.py —
Settings
Steps to Reproduce
Use a disposable instance and data directory. Paths below are relative to its HTTP base URL; bodies are JSON unless explicitly described as raw bytes. IDs shown as W/J/R/Q/C/HANDLE are replaced with the IDs returned by prior calls.
- In a fresh writable working directory, run minilake with
MINILAKE_DATA_DIR=data(equivalent to the default relative directory). - POST
/api/2.0/dbfs/putwith{"path":"/hello","contents":"aGk="}. - PUT raw bytes
hito/api/2.0/fs/files/hello. - Repeat using an absolute data directory as a control.
Expected Behavior
Both uploads work under either a relative or absolute configured root, while traversal outside that root remains rejected.
Actual Behavior
Both relative-root requests return HTTP 400, {"error_code":"INVALID_REQUEST","message":"Invalid path"}.
Root Cause Analysis
The candidate path is converted to an absolute resolved Path, but the root remains relative. Comparing an absolute path/parents to the relative root always fails containment.
Impact
The documented plain-install default breaks core file workflows. Docker defaults to /data and masks the problem.
Severity is assessed within MiniLake's documented local development/CI use; it does not assume a shared production Databricks deployment.
Suggested Fix
Resolve the root once before joining and comparing, as workspace._resolve already does. Test relative, absolute and symlinked roots while preserving traversal checks.
Test Coverage Gaps
DBFS/Files tests run with absolute /data; configuration tests do not combine the default data directory with real HTTP file operations.
Severity
Medium
Confidence
High — reproduced through the real HTTP API and traced to the source paths above.
Recommended Labels
bug
Existing Issue Matches
No reasonable duplicate found. Reviewed all open and closed issues and open pull requests in dmux/minilake, then searched component/function/symptom terms for this finding. The only open PR at review time, #29, changes the virtualenv lock entry and does not address this defect. The documented intentional limitations were checked before reporting.
Activity