📦 deps(thirdparty): update snapshots

antigravity-awesome-skills/skills/pptx-official/ooxml/scripts/unpack.py

@@ -8,6 +8,19 @@ import sys
 import zipfile
 from pathlib import Path
 
+
+def safe_user_path(path_value, base_dir="."):
+    """Resolve a CLI path under the current workspace."""
+    if base_dir != ".":
+        raise ValueError("Custom base directories are not supported for CLI paths")
+    base_path = Path.cwd().resolve()
+    resolved_path = Path(path_value).expanduser().resolve()
+    try:
+        resolved_path.relative_to(base_path)
+    except ValueError as exc:
+        raise ValueError(f"Path escapes allowed directory: {path_value}") from exc
+    return resolved_path
+
 MAX_ARCHIVE_MEMBERS = 5000
 MAX_MEMBER_SIZE = 100 * 1024 * 1024
 MAX_TOTAL_UNCOMPRESSED = 512 * 1024 * 1024
@@ -30,7 +43,7 @@ def _extract_member(archive: zipfile.ZipFile, member: zipfile.ZipInfo, output_ro
         return
 
     destination.parent.mkdir(parents=True, exist_ok=True)
-    with archive.open(member, "r") as source, open(destination, "wb") as target:
+    with archive.open(member, "r") as source, safe_user_path(destination).open("wb") as target:
         shutil.copyfileobj(source, target)
 
 
@@ -57,7 +70,7 @@ def _validate_archive_members(archive: zipfile.ZipFile, output_root: Path):
 
 
 def extract_archive_safely(input_file: str | Path, output_dir: str | Path):
-    output_path = Path(output_dir)
+    output_path = safe_user_path(output_dir)
     output_path.mkdir(parents=True, exist_ok=True)
     output_root = output_path.resolve()
 
@@ -82,7 +95,7 @@ def main(argv: list[str] | None = None):
         raise SystemExit("Usage: python unpack.py <office_file> <output_dir>")
 
     input_file, output_dir = argv
-    output_path = Path(output_dir)
+    output_path = safe_user_path(output_dir)
     extract_archive_safely(input_file, output_path)
     pretty_print_xml(output_path)