Contain all data under ./data/<env> with startup enforcement

molodetz/config.py

@@ -32,6 +32,15 @@ def _env_int(name, default):
 
 DATA_DIR = Path(_env("DATA_DIR", str(ROOT / "data"))).resolve()
 DATABASE_URL = _env("DATABASE_URL", f"sqlite:///{DATA_DIR / 'molodetz.db'}")
+DATA_ROOT = ROOT / "data"
+if DATA_DIR != DATA_ROOT and DATA_ROOT not in DATA_DIR.parents:
+    raise RuntimeError(f"refusing MOLODETZ_DATA_DIR outside {DATA_ROOT}: {DATA_DIR}")
+if DATABASE_URL.startswith("sqlite:///"):
+    DB_PATH = Path(DATABASE_URL.removeprefix("sqlite:///"))
+    if not DB_PATH.is_absolute():
+        DB_PATH = Path.cwd() / DB_PATH
+    if DATA_DIR not in DB_PATH.resolve().parents:
+        raise RuntimeError(f"refusing sqlite database file outside {DATA_DIR}: {DB_PATH}")
 PORT = _env_int("PORT", APP_PORT)
 TEST_PORT = _env_int("TEST_PORT", DEFAULT_TEST_PORT)
 SECRET_KEY = os.environ.get("SECRET_KEY", "molodetz-development-secret-change-in-production")