Skip to content

concore init accepts path-like project names and creates folders outside the current directory #588

Description

@bhuvan-somisetty

concore init <name> uses the name directly as a filesystem path, so names like ../x or an absolute path create the project outside the directory the user is in. The name is never checked, and init_project() and init_project_interactive() in concore_cli/commands/init.py both do Path(name) followed by mkdir().

Repro:

  1. mkdir work && cd work
  2. concore init ../x
  3. ls ..

The command succeeds and ../x now exists, containing src/, workflow.graphml, README.md and STUDY.json. Nothing was created inside work. A typo like concore init ../../my-study will quietly drop a project two levels up. The --interactive path behaves the same way.

Expected: a project name should be a single folder name. If it contains a path separator or .., the command should print a clear error such as Error: Project name must not contain path separators and exit without creating anything.

Actual: the folder is created wherever the path points.

Suggested fix (good first issue): add a small check at the top of both functions in init.py (or once in cli.py before they are called) that rejects names where Path(name).name != name or that are . / .., and add a test in tests/test_cli.py for ../x.

Tested on dev at d11e582, Python 3.12, Windows 11.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions