feat: add --image-dir config for image download path control#297
Merged
Conversation
Replace the broken cwd()-based path check with a configurable --image-dir (IMAGE_DIR env var) that defaults to cwd(). localPath is now resolved relative to this base directory, and the tool description dynamically includes the configured path so agents know where to save files. Also adds filenameSuffix regex validation and a defense-in-depth resolved path check in downloadFigmaImage to prevent directory traversal regardless of which parameter is the vector.
The test was only asserting isError, which also passes when the Figma API call fails for unrelated reasons. Now checks for the specific path validation error text.
LLMs frequently produce paths like "/public/images" when they mean "public/images". path.resolve treats a leading slash as absolute and ignores the base directory entirely. Switching to path.join ensures all paths are resolved relative to imageDir regardless of format.
medyas
pushed a commit
to YassineValue/Figma-Context-MCP
that referenced
this pull request
Mar 22, 2026
- Replace sharp (native C++) with jimp (pure JS) for image processing - Add --image-dir/IMAGE_DIR config for controlling image download path - Skip jimp processing for SVGs, prevent image-fill collapse in SVG containers - Handle drive root paths in image directory security check (Windows) - Add defense-in-depth path check in downloadFigmaImage - Add filenameSuffix regex validation
compassalessandrolorenz
pushed a commit
to compassalessandrolorenz/Figma-Context-MCP-AIR
that referenced
this pull request
Mar 25, 2026
* refactor: add --image-dir config and harden download path handling Replace the broken cwd()-based path check with a configurable --image-dir (IMAGE_DIR env var) that defaults to cwd(). localPath is now resolved relative to this base directory, and the tool description dynamically includes the configured path so agents know where to save files. Also adds filenameSuffix regex validation and a defense-in-depth resolved path check in downloadFigmaImage to prevent directory traversal regardless of which parameter is the vector. * test: tighten prefix-match assertion to check error message The test was only asserting isError, which also passes when the Figma API call fails for unrelated reasons. Now checks for the specific path validation error text. * fix: use path.join so leading slashes are treated as relative LLMs frequently produce paths like "/public/images" when they mean "public/images". path.resolve treats a leading slash as absolute and ignores the base directory entirely. Switching to path.join ensures all paths are resolved relative to imageDir regardless of format.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
--image-dirCLI flag /IMAGE_DIRenv var to configure where the download tool writes files, defaulting tocwd()localPathis resolved relative toimageDirusingpath.join, which gracefully handles the various path formats LLMs produce (leading slashes,./prefixes, etc.)filenameSuffixinput validation to matchfileName's existing character restrictionsdownloadFigmaImageas a second layer of path validationTest plan
--image-dirand verify download tool description includes the path