Fix plugin ID traversal vulnerability and add unit tests

Author: Vansh

backend/secuscan/scaffold.py

@@ -29,7 +29,7 @@ def generate_scaffold(
     print("=== SecuScan Plugin Scaffolding ===")
 
     # 1. Interactive Inputs & Fallbacks
-    if not plugin_id:
+    if plugin_id is None:
         while True:
             plugin_id = prompt_input("Plugin ID (e.g. my_scanner): ").lower()
             if not plugin_id:
@@ -39,6 +39,14 @@ def generate_scaffold(
                 print("[-] Plugin ID must contain only lowercase letters, numbers, underscores, or hyphens.")
                 continue
             break
+    else:
+        plugin_id = plugin_id.lower()
+        if not plugin_id:
+            print("[-] Error: Plugin ID cannot be empty.")
+            sys.exit(1)
+        if not re.match(r"^[a-z0-9_-]+$", plugin_id):
+            print("[-] Error: Plugin ID must contain only lowercase letters, numbers, underscores, or hyphens.")
+            sys.exit(1)
 
     if not name:
         name = prompt_input(f"Plugin Display Name [{plugin_id}]: ", default=plugin_id)
@@ -56,9 +64,18 @@ def generate_scaffold(
             print(f"[-] Error: Invalid safety level '{safety}'. Must be 'safe', 'intrusive', or 'exploit'.")
             sys.exit(1)
 
-    # 2. Check Existing Plugin
-    plugins_dir = Path(settings.plugins_dir)
-    target_dir = plugins_dir / plugin_id
+    # 2. Check Existing Plugin & Enforce Path Containment
+    plugins_dir = Path(settings.plugins_dir).resolve()
+    target_dir = (plugins_dir / plugin_id).resolve()
+
+    try:
+        target_dir.relative_to(plugins_dir)
+        if target_dir == plugins_dir:
+            raise ValueError()
+    except (ValueError, RuntimeError):
+        print(f"[-] Error: Target directory must be inside {plugins_dir}")
+        sys.exit(1)
+
     if target_dir.exists():
         print(f"[-] Error: Plugin directory already exists at: {target_dir}")
         sys.exit(1)
@@ -154,8 +171,15 @@ def parse_output(output: str) -> Dict[str, Any]:
 
     # 4. Write Files to Disk (Temporary without checksum)
     target_dir.mkdir(parents=True, exist_ok=True)
-    metadata_file = target_dir / "metadata.json"
-    parser_file = target_dir / "parser.py"
+    metadata_file = (target_dir / "metadata.json").resolve()
+    parser_file = (target_dir / "parser.py").resolve()
+
+    try:
+        metadata_file.relative_to(target_dir)
+        parser_file.relative_to(target_dir)
+    except (ValueError, RuntimeError):
+        print("[-] Error: Write target escaped containment.")
+        sys.exit(1)
 
     # Write initial files with LF line endings to avoid line ending/checksum issues
     metadata_file.write_text(json.dumps(metadata_template, indent=2), encoding="utf-8", newline="\n")

testing/backend/unit/test_scaffold.py

@@ -0,0 +1,63 @@
+import os
+import shutil
+import pytest
+from unittest.mock import patch
+from pathlib import Path
+from backend.secuscan.config import settings
+from backend.secuscan.scaffold import generate_scaffold
+from scripts.validate_plugin import validate_plugin
+
+@pytest.fixture
+def clean_plugins_dir(tmp_path):
+    """Temporary plugins directory to isolate scaffolding tests."""
+    original_plugins_dir = settings.plugins_dir
+    settings.plugins_dir = str(tmp_path)
+    yield tmp_path
+    settings.plugins_dir = original_plugins_dir
+
+def test_scaffold_success(clean_plugins_dir):
+    """Test successful plugin scaffolding with valid inputs."""
+    plugin_id = "test_happy_scanner"
+    generate_scaffold(plugin_id=plugin_id, name="Test Happy Scanner", safety="safe")
+
+    target_dir = clean_plugins_dir / plugin_id
+    assert target_dir.exists()
+    assert (target_dir / "metadata.json").exists()
+    assert (target_dir / "parser.py").exists()
+
+    # Validate that it passes validate_plugin script requirements
+    assert validate_plugin(target_dir) is True
+
+def test_scaffold_invalid_id_traversal(clean_plugins_dir):
+    """Test that path traversal attempts in plugin ID are rejected."""
+    with pytest.raises(SystemExit) as exc:
+        generate_scaffold(plugin_id="../../outside_scanner", name="Traversal", safety="safe")
+    assert exc.value.code == 1
+
+def test_scaffold_invalid_id_chars(clean_plugins_dir):
+    """Test that invalid characters in plugin ID are rejected."""
+    with pytest.raises(SystemExit) as exc:
+        generate_scaffold(plugin_id="Invalid@Scanner", name="Invalid", safety="safe")
+    assert exc.value.code == 1
+
+def test_scaffold_empty_id(clean_plugins_dir):
+    """Test that empty plugin ID is rejected when supplied via CLI args."""
+    with pytest.raises(SystemExit) as exc:
+        generate_scaffold(plugin_id="", name="Empty", safety="safe")
+    assert exc.value.code == 1
+
+def test_scaffold_existing_directory(clean_plugins_dir):
+    """Test that scaffolding fails if the target directory already exists."""
+    plugin_id = "duplicate_scanner"
+    target_dir = clean_plugins_dir / plugin_id
+    target_dir.mkdir()
+
+    with pytest.raises(SystemExit) as exc:
+        generate_scaffold(plugin_id=plugin_id, name="Duplicate", safety="safe")
+    assert exc.value.code == 1
+
+def test_scaffold_invalid_safety_value(clean_plugins_dir):
+    """Test that invalid safety levels are rejected."""
+    with pytest.raises(SystemExit) as exc:
+        generate_scaffold(plugin_id="valid_id", name="Valid", safety="extreme")
+    assert exc.value.code == 1