Security hardening: safe paths, CLI install, tests, and contributor docs#315
Open
ChrisFab16 wants to merge 8 commits into
Open
Security hardening: safe paths, CLI install, tests, and contributor docs#315ChrisFab16 wants to merge 8 commits into
ChrisFab16 wants to merge 8 commits into
Conversation
Add pytest and Bun test infrastructure with a unified Test workflow, replacing the broken conda workflow. Introduce CONTRIBUTING.md and a GitHub PR template so fork-based contributions stay scoped and reviewable. Document the security hardening phased plan for follow-up work (T-001–T-005). Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Lock search, design-system markdown, persist paths, and CLI template output with golden JSON fixtures and snapshots. Add detect_domain table tests, regenerate_goldens.py, and fix cli/assets resolution when running from source. Depends on Phase 0 (PR nextlevelbuilder#313). No security hardening in this change. Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Document local phase-by-phase work with one PR to upstream when the full plan is complete. Update CONTRIBUTING to match. Co-authored-by: Cursor <cursoragent@cursor.com>
Phase 2: path_utils safe_slug, validate_name_input, resolve_under_base; jail design-system persist paths; security tests. Phase 3: CLI extract via execFile (no shell); legacy install warning. Phase 4: brand sync uses execFileSync. Phase 5: shadcn component allowlist; SVG sanitization; icon import-safe. Phase 6: SECURITY.md and plan completion. 33 Python + 6 CLI tests passing. Ready for single upstream PR-FINAL. Co-authored-by: Cursor <cursoragent@cursor.com>
- Add minimal-release.zip fixture and extractZip integration test - Optional SHA-256 verify on legacy GitHub downloads when checksum assets exist - Export runTokenCssRegeneration with execFile injection; brand-sync tests Co-authored-by: Cursor <cursoragent@cursor.com>
Author
Maintainer note:
|
Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Consolidated security and quality initiative for the UI/UX Pro Max skill and
uiproCLI. Adds automated tests (pytest + Bun), golden characterization fixtures, non-breaking hardening for path traversal and shell invocation, optional SHA-256 verification on legacy GitHub installs, and contributor/PR documentation.Supersedes closed PRs: #313 (Phase 0) and #314 (Phase 1) — all work is included here in one review.
No intentional behavior change for valid inputs (search, design-system generation, default
uipro init).Maintainer note (documentation)
CONTRIBUTING.mdand.github/pull_request_template.mddo not exist on upstreammaintoday. This PR proposes them as suggested maintainer docs (fork workflow, PR checklist, test commands). They can be merged as-is, edited, or omitted without blocking the security/test changes.Type of change
Phases delivered
test.ymlCI,Makefile, remove broken conda workflowpath_utils.py— slug sanitization, path jail for--persistextract.ts—execFile(no shell); legacy install warningsync-brand-to-tokens.cjs—execFileSyncSECURITY.md,CONTRIBUTING.md, PR template, plan docSecurity fixes (review focus)
--persistpath traversal —validate_name_input+resolve_under_base; writes only underdesign-system/<slug>/unzip/cpstrings; optional SHA-256 when release publishesSHA256SUMSor*.zip.sha256nodecommand<script>/ event handlersHow to review
src/ui-ux-pro-max/scripts/path_utils.py+design_system.pypersist changescli/src/utils/extract.ts,checksum.ts,github.tstests/python/golden/andtests/python/security/CONTRIBUTING.md,SECURITY.md,.github/pull_request_template.md.github/workflows/test.ymlTest plan
pip install -e ".[test]" && make test— 33 Python + 15 CLI passed locallypytest tests/python/golden -vpytest tests/python/security -vCLI / assets sync
cli/assets/scripts/(design_system.py,path_utils.py) fromsrc/ui-ux-pro-max/Golden / snapshot tests
User-facing impact
--persistproject/page names now error instead of writing outsidedesign-system/--legacyinstall warns about unverified download; verifies checksum when maintainers publish digest filesChecklist
mainfrom forkChrisFab16:feat/security-hardeningdocs/security-hardening-plan.mdAfter merge: enable branch protection requiring the Test workflow on
main.Made with Cursor