📦 deps(thirdparty): update snapshots

antigravity-awesome-skills/skills/docx-official/ooxml/scripts/pack.py

@@ -16,6 +16,19 @@ import zipfile
 from pathlib import Path
 
 
+def safe_user_path(path_value, base_dir="."):
+    """Resolve a CLI path under the current workspace."""
+    if base_dir != ".":
+        raise ValueError("Custom base directories are not supported for CLI paths")
+    base_path = Path.cwd().resolve()
+    resolved_path = Path(path_value).expanduser().resolve()
+    try:
+        resolved_path.relative_to(base_path)
+    except ValueError as exc:
+        raise ValueError(f"Path escapes allowed directory: {path_value}") from exc
+    return resolved_path
+
+
 def validate_input_tree(input_dir: Path):
     root = input_dir.resolve(strict=True)
     for path in input_dir.rglob("*"):
@@ -27,6 +40,18 @@ def validate_input_tree(input_dir: Path):
             raise ValueError(f"Refusing to pack path outside input directory: {path}") from None
 
 
+def copy_tree_contents(source_dir: Path, target_dir: Path) -> None:
+    target_dir.mkdir(parents=True, exist_ok=True)
+    for source_path in source_dir.rglob("*"):
+        relative_path = source_path.relative_to(source_dir)
+        target_path = target_dir / relative_path
+        if source_path.is_dir():
+            target_path.mkdir(parents=True, exist_ok=True)
+        elif source_path.is_file():
+            target_path.parent.mkdir(parents=True, exist_ok=True)
+            target_path.write_bytes(source_path.read_bytes())
+
+
 def main():
     parser = argparse.ArgumentParser(description="Pack a directory into an Office file")
     parser.add_argument("input_directory", help="Unpacked Office document directory")
@@ -65,7 +90,7 @@ def pack_document(input_dir, output_file, validate=False):
         bool: True if successful, False if validation failed
     """
     input_dir = Path(input_dir)
-    output_file = Path(output_file)
+    output_file = safe_user_path(output_file)
 
     if not input_dir.is_dir():
         raise ValueError(f"{input_dir} is not a directory")
@@ -76,7 +101,7 @@ def pack_document(input_dir, output_file, validate=False):
     # Work in temporary directory to avoid modifying original
     with tempfile.TemporaryDirectory() as temp_dir:
         temp_content_dir = Path(temp_dir) / "content"
-        shutil.copytree(input_dir, temp_content_dir)
+        copy_tree_contents(input_dir, temp_content_dir)
 
         # Process XML files to remove pretty-printing whitespace
         for pattern in ["*.xml", "*.rels"]:
@@ -85,10 +110,12 @@ def pack_document(input_dir, output_file, validate=False):
 
         # Create final Office file as zip archive
         output_file.parent.mkdir(parents=True, exist_ok=True)
-        with zipfile.ZipFile(output_file, "w", zipfile.ZIP_DEFLATED) as zf:
+        temp_zip_path = Path(temp_dir) / "office.zip"
+        with zipfile.ZipFile(temp_zip_path, "w", zipfile.ZIP_DEFLATED) as zf:
             for f in temp_content_dir.rglob("*"):
                 if f.is_file():
                     zf.write(f, f.relative_to(temp_content_dir))
+        output_file.write_bytes(temp_zip_path.read_bytes())
 
         # Validate if requested
         if validate:

antigravity-awesome-skills/skills/docx-official/ooxml/scripts/unpack.py

@@ -8,6 +8,19 @@ import sys
 import zipfile
 from pathlib import Path
 
+
+def safe_user_path(path_value, base_dir="."):
+    """Resolve a CLI path under the current workspace."""
+    if base_dir != ".":
+        raise ValueError("Custom base directories are not supported for CLI paths")
+    base_path = Path.cwd().resolve()
+    resolved_path = Path(path_value).expanduser().resolve()
+    try:
+        resolved_path.relative_to(base_path)
+    except ValueError as exc:
+        raise ValueError(f"Path escapes allowed directory: {path_value}") from exc
+    return resolved_path
+
 MAX_ARCHIVE_MEMBERS = 5000
 MAX_MEMBER_SIZE = 100 * 1024 * 1024
 MAX_TOTAL_UNCOMPRESSED = 512 * 1024 * 1024
@@ -30,7 +43,7 @@ def _extract_member(archive: zipfile.ZipFile, member: zipfile.ZipInfo, output_ro
         return
 
     destination.parent.mkdir(parents=True, exist_ok=True)
-    with archive.open(member, "r") as source, open(destination, "wb") as target:
+    with archive.open(member, "r") as source, safe_user_path(destination).open("wb") as target:
         shutil.copyfileobj(source, target)
 
 
@@ -57,7 +70,7 @@ def _validate_archive_members(archive: zipfile.ZipFile, output_root: Path):
 
 
 def extract_archive_safely(input_file: str | Path, output_dir: str | Path):
-    output_path = Path(output_dir)
+    output_path = safe_user_path(output_dir)
     output_path.mkdir(parents=True, exist_ok=True)
     output_root = output_path.resolve()
 
@@ -82,7 +95,7 @@ def main(argv: list[str] | None = None):
         raise SystemExit("Usage: python unpack.py <office_file> <output_dir>")
 
     input_file, output_dir = argv
-    output_path = Path(output_dir)
+    output_path = safe_user_path(output_dir)
     extract_archive_safely(input_file, output_path)
     pretty_print_xml(output_path)