📦 deps(thirdparty): update snapshots

antigravity-awesome-skills/skills/pptx-official/scripts/inventory.py

@@ -28,6 +28,19 @@ import platform
 import sys
 from dataclasses import dataclass
 from pathlib import Path
+
+
+def safe_user_path(path_value, base_dir="."):
+    """Resolve a CLI path under the current workspace."""
+    if base_dir != ".":
+        raise ValueError("Custom base directories are not supported for CLI paths")
+    base_path = Path.cwd().resolve()
+    resolved_path = Path(path_value).expanduser().resolve()
+    try:
+        resolved_path.relative_to(base_path)
+    except ValueError as exc:
+        raise ValueError(f"Path escapes allowed directory: {path_value}") from exc
+    return resolved_path
 from typing import Any, Dict, List, Optional, Tuple, Union
 
 from PIL import Image, ImageDraw, ImageFont
@@ -79,7 +92,7 @@ The output JSON includes:
 
     args = parser.parse_args()
 
-    input_path = Path(args.input)
+    input_path = safe_user_path(args.input)
     if not input_path.exists():
         print(f"Error: Input file not found: {args.input}")
         sys.exit(1)
@@ -96,7 +109,7 @@ The output JSON includes:
             )
         inventory = extract_text_inventory(input_path, issues_only=args.issues_only)
 
-        output_path = Path(args.output)
+        output_path = safe_user_path(args.output)
         output_path.parent.mkdir(parents=True, exist_ok=True)
         save_inventory(inventory, output_path)
 
@@ -1012,8 +1025,8 @@ def save_inventory(inventory: InventoryData, output_path: Path) -> None:
             shape_key: shape_data.to_dict() for shape_key, shape_data in shapes.items()
         }
 
-    with open(output_path, "w", encoding="utf-8") as f:
-        json.dump(json_inventory, f, indent=2, ensure_ascii=False)
+    with safe_user_path(output_path).open("w", encoding="utf-8") as f:
+        f.write(json.dumps(json_inventory, indent=2, ensure_ascii=False))
 
 
 if __name__ == "__main__":

antigravity-awesome-skills/skills/pptx-official/scripts/rearrange.py

@@ -15,6 +15,19 @@ import sys
 from copy import deepcopy
 from pathlib import Path
 
+
+def safe_user_path(path_value, base_dir="."):
+    """Resolve a CLI path under the current workspace."""
+    if base_dir != ".":
+        raise ValueError("Custom base directories are not supported for CLI paths")
+    base_path = Path.cwd().resolve()
+    resolved_path = Path(path_value).expanduser().resolve()
+    try:
+        resolved_path.relative_to(base_path)
+    except ValueError as exc:
+        raise ValueError(f"Path escapes allowed directory: {path_value}") from exc
+    return resolved_path
+
 import six
 from pptx import Presentation
 
@@ -53,13 +66,13 @@ Note: Slide indices are 0-based (first slide is 0, second is 1, etc.)
         sys.exit(1)
 
     # Check template exists
-    template_path = Path(args.template)
+    template_path = safe_user_path(args.template)
     if not template_path.exists():
         print(f"Error: Template file not found: {args.template}")
         sys.exit(1)
 
     # Create output directory if needed
-    output_path = Path(args.output)
+    output_path = safe_user_path(args.output)
     output_path.parent.mkdir(parents=True, exist_ok=True)
 
     try:

antigravity-awesome-skills/skills/pptx-official/scripts/replace.py

@@ -12,6 +12,19 @@ unless "paragraphs" is specified in the replacements for that shape.
 import json
 import sys
 from pathlib import Path
+
+
+def safe_user_path(path_value, base_dir="."):
+    """Resolve a CLI path under the current workspace."""
+    if base_dir != ".":
+        raise ValueError("Custom base directories are not supported for CLI paths")
+    base_path = Path.cwd().resolve()
+    resolved_path = Path(path_value).expanduser().resolve()
+    try:
+        resolved_path.relative_to(base_path)
+    except ValueError as exc:
+        raise ValueError(f"Path escapes allowed directory: {path_value}") from exc
+    return resolved_path
 from typing import Any, Dict, List
 
 from inventory import InventoryData, extract_text_inventory
@@ -359,9 +372,9 @@ def main():
         print(__doc__)
         sys.exit(1)
 
-    input_pptx = Path(sys.argv[1])
-    replacements_json = Path(sys.argv[2])
-    output_pptx = Path(sys.argv[3])
+    input_pptx = safe_user_path(sys.argv[1])
+    replacements_json = safe_user_path(sys.argv[2])
+    output_pptx = safe_user_path(sys.argv[3])
 
     if not input_pptx.exists():
         print(f"Error: Input file '{input_pptx}' not found")