fix: minor security hardening

[toddbaert]

Validate the constructed path in lint_json_output.py to prevent path traversal.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: a07cbfcb-8749-48ad-8cc9-87a5ba7985f6

📥 Commits

Reviewing files that changed from the base of the PR and between 4741e99 and d144658.

📒 Files selected for processing (1)

• tools/specification_parser/lint_json_output.py

🚧 Files skipped from review as they are similar to previous changes (1)

• tools/specification_parser/lint_json_output.py

---

📝 Walkthrough

Walkthrough

The JSON linter now resolves input paths and rejects targets outside the current working directory before parsing.

Changes

Safe path validation

Layer / File(s)	Summary
Path validation and parser integration tools/specification_parser/lint_json_output.py	Adds _safe_path to validate resolved paths, reports rejected paths to stderr with exit status 1, and applies the check before JSON file access.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Title check	❓ Inconclusive	The title is related to the change but too vague to convey that it hardens path validation in lint_json_output.py.	Rename it to something specific like 'fix: prevent path traversal in lint_json_output.py'.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description directly matches the path traversal validation added to lint_json_output.py.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tools/specification_parser/lint_json_output.py`:
- Around line 9-11: Update the path validation flow around base and target to
use realpath() for both values before commonpath() containment checking, reject
targets whose resolved common path differs from the resolved base, and open the
resolved target rather than the original input path.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 128aa5c5-e605-41c2-986c-fe2642f79bbf

📥 Commits

Reviewing files that changed from the base of the PR and between ff08ac1 and 4741e99.

📒 Files selected for processing (1)

• tools/specification_parser/lint_json_output.py