Missing path traversal validation on --output parameter

[tembo]

Security Vulnerability Report

Severity: Medium

Vulnerability Type: Path Traversal

Affected Files and Lines

• src/commands/blog.ts - Lines 514-525

Code Snippet

let outputDir: string;
if (options.output) {
  outputDir = options.output;
} else if (config.blog?.outputDir) {
  outputDir = config.blog.outputDir;
} else {
  // Try to find existing content directory, or use framework default
  const existingDir = findExistingContentDir(cwd, framework);
  outputDir = existingDir || frameworkConfig.draftsDir;
}

if (!existsSync(outputDir)) {
  mkdirSync(outputDir, { recursive: true });
}

Description

The --output parameter from CLI arguments is used directly to create directories without proper path traversal validation. If a user provides a path like ../../../, it could potentially write files outside the intended project directory.

Impact

• Files could be written outside the intended project directory
• Potential overwriting of system files if running with elevated privileges
• Data could be placed in unexpected locations

Recommended Fix

Add path validation:

import { resolve } from 'path';

if (options.output) {
  const resolved = resolve(cwd, options.output);
  // Ensure the resolved path is within or descendent of cwd
  if (!resolved.startsWith(resolve(cwd))) {
    throw new Error(`Invalid output directory: path traversal detected`);
  }
  outputDir = resolved;
}

References

• CWE-22: Path Traversal
• OWASP Path Traversal

[tembo]

This is a duplicate of #38 which covers the same --output path traversal vulnerability in src/commands/blog.ts. Issue #38 also addresses the config.blog.outputDir case and has a more comprehensive fix suggestion using relative() to detect traversal.

Related path handling issues in this codebase that should probably be fixed together:

• #43 - HOME directory manipulation (same file, lines 470-560)
• #35 / #51 - HOME env var for token loading

Consider creating a shared validatePath() utility in src/utils/ that can be reused across all these cases:

import { resolve } from 'path';

export function validatePathWithinBase(basePath: string, userPath: string): string {
  const resolved = resolve(basePath, userPath);
  if (!resolved.startsWith(resolve(basePath) + '/') && resolved !== resolve(basePath)) {
    throw new Error('Path traversal detected');
  }
  return resolved;
}

Note: The codebase currently doesn't import resolve from path anywhere in src/commands/blog.ts - you'll need to add that import.