fix: improved validation

Signed-off-by: degenaro <lou.degenaro@gmail.com>

Author: degenaro

tests/trestle/core/commands/author/jinja_cmd_test.py

@@ -355,6 +355,12 @@ def test_jinja_docs_profile_path_traversal_protection(tmp_trestle_dir: pathlib.P
         PathSecurityValidator.validate_local_path(output_file, tmp_trestle_dir)
     assert 'Security violation' in str(exc_info.value)
 
-    # Test 3: Valid relative path should succeed
+    # Test 3: Directory creation path traversal should fail
+    with pytest.raises(TrestleError) as exc_info:
+        group_dir = tmp_trestle_dir / '../../../etc/malicious'
+        PathSecurityValidator.validate_local_path(group_dir, tmp_trestle_dir)
+    assert 'Security violation' in str(exc_info.value)
+
+    # Test 4: Valid relative path should succeed
     output_file = tmp_trestle_dir / 'controls_output/ac/ac-1.md'
     PathSecurityValidator.validate_local_path(output_file, tmp_trestle_dir)  # Should not raise

trestle/core/commands/author/jinja.py

@@ -278,8 +278,11 @@ def jinja_multiple_md(
                 control_path = catalog_interface.get_control_path(control.id)
                 for sub_dir in control_path:
                     group_dir = group_dir / sub_dir
-                    if not group_dir.exists():
-                        group_dir.mkdir(parents=True, exist_ok=True)
+                    # Validate directory path to prevent path traversal before creating directories
+                    full_group_dir = trestle_root / group_dir
+                    PathSecurityValidator.validate_local_path(full_group_dir, trestle_root)
+                    if not full_group_dir.exists():
+                        full_group_dir.mkdir(parents=True, exist_ok=True)
 
                 control_writer = DocsControlWriter()