Merge commit from fork

* fix: jinja write

Signed-off-by: degenaro <lou.degenaro@gmail.com>

* fix: improve validation

Signed-off-by: degenaro <lou.degenaro@gmail.com>

---------

Signed-off-by: degenaro <lou.degenaro@gmail.com>

Author: degenaro

tests/trestle/core/commands/author/jinja_cmd_test.py

@@ -17,10 +17,13 @@
 import pathlib
 import shutil
 
+import pytest
+
 from _pytest.monkeypatch import MonkeyPatch
 
 from tests.test_utils import execute_command_and_assert, setup_for_ssp
 
+from trestle.common.err import TrestleError
 from trestle.core.commands.author.jinja import _number_captions
 from trestle.core.commands.author.ssp import SSPGenerate
 from trestle.core.markdown.docs_markdown_node import DocsMarkdownNode
@@ -295,3 +298,69 @@ def test_jinja_with_template_only(
         node1 = tree.get_node_for_key('# A')
         node2 = tree.get_node_for_key('# C')
         assert node1.subnodes[0].key == node2.subnodes[0].key
+
+
+def test_jinja_path_traversal_protection(
+    testdata_dir: pathlib.Path, tmp_trestle_dir: pathlib.Path, monkeypatch: MonkeyPatch
+) -> None:
+    """Test that path traversal attacks are blocked in jinja command."""
+    from trestle.core.remote.security import PathSecurityValidator
+
+    # Test path validation directly to ensure 100% coverage of the validation code
+    # Test 1: Path traversal with ../ should fail
+    with pytest.raises(TrestleError) as exc_info:
+        output_file = tmp_trestle_dir / '../../../etc/passwd'
+        PathSecurityValidator.validate_local_path(output_file, tmp_trestle_dir)
+    assert 'Security violation' in str(exc_info.value)
+    assert 'Path traversal blocked' in str(exc_info.value)
+
+    # Test 2: Path traversal with multiple ../ should fail
+    with pytest.raises(TrestleError) as exc_info:
+        output_file = tmp_trestle_dir / 'subdir/../../poc.txt'
+        PathSecurityValidator.validate_local_path(output_file, tmp_trestle_dir)
+    assert 'Security violation' in str(exc_info.value)
+
+    # Test 3: Absolute path should fail
+    with pytest.raises(TrestleError) as exc_info:
+        output_file = pathlib.Path('/tmp/attack.md')
+        PathSecurityValidator.validate_local_path(output_file, tmp_trestle_dir)
+    assert 'Security violation' in str(exc_info.value)
+
+    # Test 4: Complex traversal should fail
+    with pytest.raises(TrestleError) as exc_info:
+        output_file = tmp_trestle_dir / 'a/b/c/../../../../etc/passwd'
+        PathSecurityValidator.validate_local_path(output_file, tmp_trestle_dir)
+    assert 'Security violation' in str(exc_info.value)
+
+    # Test 5: Valid relative path should succeed
+    output_file = tmp_trestle_dir / 'output/valid.md'
+    PathSecurityValidator.validate_local_path(output_file, tmp_trestle_dir)  # Should not raise
+
+
+def test_jinja_docs_profile_path_traversal_protection(tmp_trestle_dir: pathlib.Path) -> None:
+    """Test that path traversal attacks are blocked in jinja docs-profile mode."""
+    from trestle.core.remote.security import PathSecurityValidator
+
+    # Test validation for multi-file output paths
+    # Test 1: Path traversal in output directory should fail
+    with pytest.raises(TrestleError) as exc_info:
+        output_file = tmp_trestle_dir / '../../../etc/ac-1.md'
+        PathSecurityValidator.validate_local_path(output_file, tmp_trestle_dir)
+    assert 'Security violation' in str(exc_info.value)
+    assert 'Path traversal blocked' in str(exc_info.value)
+
+    # Test 2: Complex path traversal should fail
+    with pytest.raises(TrestleError) as exc_info:
+        output_file = tmp_trestle_dir / 'controls/../../tmp/ac-1.md'
+        PathSecurityValidator.validate_local_path(output_file, tmp_trestle_dir)
+    assert 'Security violation' in str(exc_info.value)
+
+    # Test 3: Directory creation path traversal should fail
+    with pytest.raises(TrestleError) as exc_info:
+        group_dir = tmp_trestle_dir / '../../../etc/malicious'
+        PathSecurityValidator.validate_local_path(group_dir, tmp_trestle_dir)
+    assert 'Security violation' in str(exc_info.value)
+
+    # Test 4: Valid relative path should succeed
+    output_file = tmp_trestle_dir / 'controls_output/ac/ac-1.md'
+    PathSecurityValidator.validate_local_path(output_file, tmp_trestle_dir)  # Should not raise

trestle/core/commands/author/jinja.py

@@ -30,6 +30,7 @@
 from trestle.common import const, log
 from trestle.common.err import TrestleIncorrectArgsError, handle_generic_command_exception
 from trestle.common.load_validate import load_validate_model_name
+from trestle.core.remote.security import PathSecurityValidator
 from trestle.common.model_utils import ModelUtils
 from trestle.core.catalog.catalog_interface import CatalogInterface
 from trestle.core.commands.command_docs import CommandPlusDocs
@@ -228,7 +229,10 @@ def jinja_ify(
 
         output = JinjaCmd.render_template(template, lut, template_folder)
 
+        # Validate output path to prevent path traversal
         output_file = trestle_root / r_output_file
+        PathSecurityValidator.validate_local_path(output_file, trestle_root)
+
         if number_captions:
             output_file.open('w', encoding=const.FILE_ENCODING).write(_number_captions(output))
         else:
@@ -274,8 +278,11 @@ def jinja_multiple_md(
                 control_path = catalog_interface.get_control_path(control.id)
                 for sub_dir in control_path:
                     group_dir = group_dir / sub_dir
-                    if not group_dir.exists():
-                        group_dir.mkdir(parents=True, exist_ok=True)
+                    # Validate directory path to prevent path traversal before creating directories
+                    full_group_dir = trestle_root / group_dir
+                    PathSecurityValidator.validate_local_path(full_group_dir, trestle_root)
+                    if not full_group_dir.exists():
+                        full_group_dir.mkdir(parents=True, exist_ok=True)
 
                 control_writer = DocsControlWriter()
 
@@ -291,7 +298,11 @@ def jinja_multiple_md(
                 lut['group_title'] = group_title
                 output = JinjaCmd.render_template(template, lut, template_folder)
 
-                output_file = trestle_root / group_dir / pathlib.Path(control.id + const.MARKDOWN_FILE_EXT)
+                # Validate output path to prevent path traversal
+                relative_output_path = group_dir / pathlib.Path(control.id + const.MARKDOWN_FILE_EXT)
+                output_file = trestle_root / relative_output_path
+                PathSecurityValidator.validate_local_path(output_file, trestle_root)
+
                 output_file.open('w', encoding=const.FILE_ENCODING).write(output)
 
         return CmdReturnCodes.SUCCESS.value