Harden extension URL download cache

Assisted-by: GitHub Copilot (model: MAI-Code-1-Flash, autonomous)
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 8f71e02a-bc64-4593-b305-2554debe96f6

Author: mnriem

src/specify_cli/extensions/_commands.py

@@ -751,27 +751,35 @@ def extension_add(
                             )
                             raise typer.Exit(1)
 
-                        download_file = os.fdopen(download_fd, "w+b")
-                        download_fd = -1
-                        download_file.write(zip_data)
-                        download_file.flush()
-                        download_file.seek(0)
+                        try:
+                            download_file = os.fdopen(download_fd, "w+b")
+                            download_fd = -1
+                            download_file.write(zip_data)
+                            download_file.flush()
+                            download_file.seek(0)
+                        except OSError as exc:
+                            console.print(
+                                "[red]Error:[/red] Could not safely write download file: "
+                                f"{_escape_markup(str(exc))}"
+                            )
+                            raise typer.Exit(1)
 
                         # Consume the inode reserved above rather than reopening
                         # the mutable cache pathname during extraction.
-                        manifest = manager.install_from_zip(
-                            zip_path,
-                            speckit_version,
-                            priority=priority,
-                            force=force,
-                            archive_file=download_file,
-                        )
-                    except OSError as exc:
-                        console.print(
-                            "[red]Error:[/red] Could not safely write download file: "
-                            f"{_escape_markup(str(exc))}"
-                        )
-                        raise typer.Exit(1)
+                        try:
+                            manifest = manager.install_from_zip(
+                                zip_path,
+                                speckit_version,
+                                priority=priority,
+                                force=force,
+                                archive_file=download_file,
+                            )
+                        except OSError as exc:
+                            console.print(
+                                "[red]Error:[/red] Could not install extension from downloaded archive: "
+                                f"{_escape_markup(str(exc))}"
+                            )
+                            raise typer.Exit(1)
                     finally:
                         if download_file is not None:
                             try:

tests/test_extension_add_path_traversal.py

@@ -23,7 +23,11 @@
 
 
 def _require_secure_dir_fd() -> None:
-    if not getattr(os, "O_NOFOLLOW", 0) or os.open not in os.supports_dir_fd:
+    if (
+        not getattr(os, "O_NOFOLLOW", 0)
+        or os.open not in os.supports_dir_fd
+        or os.mkdir not in os.supports_dir_fd
+    ):
         pytest.skip("requires dir_fd and O_NOFOLLOW support")
 
 

tests/test_extensions.py

@@ -58,6 +58,13 @@ def _open_test_download_zip(project_root, download_dir, zip_filename):
     )
 
 
+def _validate_safe_cache_dir_test_stand_in(project_root):
+    """Cross-platform stand-in for the secure cache validator."""
+    download_dir = project_root / ".specify" / "extensions" / ".cache" / "downloads"
+    download_dir.mkdir(parents=True, exist_ok=True)
+    return download_dir
+
+
 def can_create_symlink(tmp_path: Path) -> bool:
     """Return True when the current platform/user can create file symlinks."""
     target = tmp_path / "symlink-target.txt"
@@ -7416,6 +7423,7 @@ def fake_install_from_zip(
         runner = CliRunner()
         with patch.object(Path, "cwd", return_value=project_dir), \
              patch("typer.confirm", return_value=True), \
+             patch("specify_cli.extensions._commands._validate_safe_cache_dir", side_effect=_validate_safe_cache_dir_test_stand_in), \
              patch("specify_cli.authentication.http.open_url", return_value=FakeResponse(_MINIMAL_ZIP_BYTES)), \
              patch("specify_cli.extensions._commands._safe_open_download_zip", side_effect=_open_test_download_zip), \
              patch.object(ExtensionManager, "install_from_zip", fake_install_from_zip), \
@@ -7465,6 +7473,7 @@ def test_add_from_url_escapes_download_exception_markup(self, tmp_path):
         runner = CliRunner()
         with patch.object(Path, "cwd", return_value=project_dir), \
              patch("typer.confirm", return_value=True), \
+             patch("specify_cli.extensions._commands._validate_safe_cache_dir", side_effect=_validate_safe_cache_dir_test_stand_in), \
              patch(
                  "specify_cli.authentication.http.open_url",
                  side_effect=urllib.error.URLError("bad [red]download[/red]"),
@@ -7506,6 +7515,7 @@ def __exit__(self, exc_type, exc, tb):
         runner = CliRunner()
         with patch.object(Path, "cwd", return_value=project_dir), \
              patch("typer.confirm", return_value=True), \
+             patch("specify_cli.extensions._commands._validate_safe_cache_dir", side_effect=_validate_safe_cache_dir_test_stand_in), \
              patch(
                  "specify_cli.authentication.http.open_url",
                  return_value=FakeResponse(b"<!DOCTYPE html><html>Sign in</html>"),
@@ -7556,6 +7566,7 @@ def reject_oversized(*_args, **_kwargs):
         runner = CliRunner()
         with patch.object(Path, "cwd", return_value=project_dir), \
              patch("typer.confirm", return_value=True), \
+             patch("specify_cli.extensions._commands._validate_safe_cache_dir", side_effect=_validate_safe_cache_dir_test_stand_in), \
              patch(
                  "specify_cli.authentication.http.open_url",
                  return_value=FakeResponse(_MINIMAL_ZIP_BYTES),
@@ -7627,6 +7638,7 @@ def fake_install(
         runner = CliRunner()
         with patch.object(Path, "cwd", return_value=project_dir), \
              patch("typer.confirm", return_value=True), \
+             patch("specify_cli.extensions._commands._validate_safe_cache_dir", side_effect=_validate_safe_cache_dir_test_stand_in), \
              patch("specify_cli.authentication.http.github_provider_hosts", return_value=("ghes.example",)), \
              patch("specify_cli.authentication.http.open_url", side_effect=fake_open_url), \
              patch("specify_cli.extensions._commands._safe_open_download_zip", side_effect=_open_test_download_zip), \
@@ -7728,6 +7740,7 @@ def fake_install_from_zip(
         runner = CliRunner()
         with patch.object(Path, "cwd", return_value=project_dir), \
              patch("typer.confirm", return_value=True), \
+             patch("specify_cli.extensions._commands._validate_safe_cache_dir", side_effect=_validate_safe_cache_dir_test_stand_in), \
              patch("specify_cli.authentication.http.open_url", return_value=FakeResponse(_MINIMAL_ZIP_BYTES)), \
              patch("specify_cli.extensions._commands._safe_open_download_zip", side_effect=_open_test_download_zip), \
              patch.object(ExtensionManager, "install_from_zip", fake_install_from_zip):