Security Report — Path Traversal via API-Controlled File Paths in figma_to_code

[Dingisoul-DEV]

Affected tools: figma_to_code

Severity

MEDIUM — Path Traversal via Unvalidated API-Controlled File Paths

Description

In helpers/downloader.ts, the saveContentToFile function constructs the output path by joining the user-supplied localPath with file.path returned by the third-party API:

const fullPath = path.join(this.savePath, filePath)
await fsp.writeFile(fullPath, content)

path.join normalizes paths but does not prevent directory traversal. If the API returns a malicious file.path such as ../../.ssh/authorized_keys, the resolved path escapes localPath:

path.join('/home/user/output', '../../.ssh/authorized_keys')
// → '/home/user/.ssh/authorized_keys'

Impact

A compromised or malicious third-party API can write arbitrary content to arbitrary locations on the host filesystem, potentially overwriting SSH keys, shell configs, or other sensitive files.

Fix

After computing fullPath, assert it stays within savePath before writing:

const fullPath = path.resolve(this.savePath, filePath)
if (!fullPath.startsWith(path.resolve(this.savePath) + path.sep)) {
  throw new Error(`Rejected unsafe path: ${filePath}`)
}
await fsp.writeFile(fullPath, content)

path.resolve fully normalizes the path including .. sequences, and the prefix check ensures the result remains within the intended directory.