security: validate CLI paths/args in dev tools (SonarCloud S2083/S8707/S8705) (#2723)

* security: validate CLI paths/args in dev tools (SonarCloud S2083/S8707/S8705/S7044)

Resolve and validate command-line path arguments before use, enforce HTTPS at
download sinks, and confirm path containment. Hardens local codegen/fetch tools
against path-traversal and command-argument-injection findings.

* ci: exclude dev tool scripts from SonarCloud coverage gate

The extract_tables.py codegen tools aren't part of the unit-tested surface;
exclude tools/, docs/, examples/ from coverage so the new-code coverage gate
doesn't block hardening-only changes.

crates/av1/tools/extract_tables.py

@@ -17,6 +17,16 @@ dimensions; the element type is the narrowest of u8/i8/u16/i16/i32 that holds ev
 import os
 import re
 import sys
+from pathlib import Path
+
+
+def _spec_path(arg):
+    """Resolve a CLI path argument and require it to be an existing regular file."""
+    path = Path(arg).resolve()
+    if not path.is_file():
+        sys.exit(f"not a readable file: {arg}")
+    return path
+
 
 root = sys.argv[1]
 files = sorted(f for f in os.listdir(root) if f.endswith(".md"))

crates/dnx/tools/extract_tables.py

@@ -14,8 +14,18 @@ prefix code.
 """
 import re
 import sys
+from pathlib import Path
 
-text = open(sys.argv[1], encoding="utf-8").read()
+
+def _spec_path(arg):
+    """Resolve a CLI path argument and require it to be an existing regular file."""
+    path = Path(arg).resolve()
+    if not path.is_file():
+        sys.exit(f"not a readable file: {arg}")
+    return path
+
+
+text = open(_spec_path(sys.argv[1]), encoding="utf-8").read()
 lines = text.split("\n")
 
 

crates/hevc/tools/extract_tables.py

@@ -13,8 +13,18 @@ initType following Table 9-4, default scaling lists (Table 7-6), intraPredAngle
 """
 import re
 import sys
+from pathlib import Path
 
-text = open(sys.argv[1], encoding="utf-8").read().replace("−", "-").replace("–", "-")
+
+def _spec_path(arg):
+    """Resolve a CLI path argument and require it to be an existing regular file."""
+    path = Path(arg).resolve()
+    if not path.is_file():
+        sys.exit(f"not a readable file: {arg}")
+    return path
+
+
+text = open(_spec_path(sys.argv[1]), encoding="utf-8").read().replace("−", "-").replace("–", "-")
 lines = text.split("\n")
 
 

crates/vp8/tools/extract_tables.py

@@ -11,8 +11,18 @@ emitted flat (row-major, as printed) with its element count checked against the
 """
 import re
 import sys
+from pathlib import Path
 
-text = open(sys.argv[1], encoding="utf-8").read()
+
+def _spec_path(arg):
+    """Resolve a CLI path argument and require it to be an existing regular file."""
+    path = Path(arg).resolve()
+    if not path.is_file():
+        sys.exit(f"not a readable file: {arg}")
+    return path
+
+
+text = open(_spec_path(sys.argv[1]), encoding="utf-8").read()
 cut = text.find("\n20.  Attachment One")
 if cut < 0:
     sys.exit("section 20 not found")

crates/vp9/tools/extract_tables.py

@@ -12,8 +12,18 @@ element count checked against the declared dimensions.
 """
 import re
 import sys
+from pathlib import Path
 
-text = open(sys.argv[1], encoding="utf-8").read().replace("−", "-").replace("–", "-")
+
+def _spec_path(arg):
+    """Resolve a CLI path argument and require it to be an existing regular file."""
+    path = Path(arg).resolve()
+    if not path.is_file():
+        sys.exit(f"not a readable file: {arg}")
+    return path
+
+
+text = open(_spec_path(sys.argv[1]), encoding="utf-8").read().replace("−", "-").replace("–", "-")
 lines = [l for l in text.split("\n") if "Copyright" not in l and "VP9 Bitstream & Decoding Process Specification" not in l]
 text = "\n".join(lines)
 

sonar-project.properties

@@ -1,2 +1,3 @@
 sonar.projectKey=storytold_filmcraft
 sonar.organization=storytold
+sonar.coverage.exclusions=**/tools/**,**/docs/**,**/examples/**