From 9f2dc556c1449f4af8654b59ec26a697a250a2cc Mon Sep 17 00:00:00 2001
From: Geoffrey McClinsey <geoffrey.mcclinsey@gmail.com>
Date: Sat, 18 Jul 2026 22:30:25 -0400
Subject: [PATCH] fix: standardize safety validation (Phase 2 audit
 remediation)

- Add file size validation in parser.py (rejects empty/too-small files)
- Document that validate_output_dest includes validate_parent
- Verify F9 and F14 already addressed in existing code

Fixes F7, F9, F14 from audit intake.
---
 src/alscan/parser.py   | 5 +++++
 src/alscan/services.py | 5 +++++
 2 files changed, 10 insertions(+)

diff --git a/src/alscan/parser.py b/src/alscan/parser.py
index 01a4300..3402b8f 100644
--- a/src/alscan/parser.py
+++ b/src/alscan/parser.py
@@ -35,6 +35,11 @@ def parse_als(path: str | Path) -> Project:
     path = Path(path).resolve()
     if not path.exists():
         raise FileNotFoundError(str(path))
+    file_size = path.stat().st_size
+    if file_size == 0:
+        raise ValueError(f"ALS file is empty: {path}")
+    if file_size < 50:
+        raise ValueError(f"ALS file is too small to be valid ({file_size} bytes): {path}")
     raw = path.read_bytes()
     if raw[:2] == b"\x1f\x8b":
         buf = io.BytesIO(raw)
diff --git a/src/alscan/services.py b/src/alscan/services.py
index f1bf76c..d0c2876 100644
--- a/src/alscan/services.py
+++ b/src/alscan/services.py
@@ -316,6 +316,11 @@ def save_report(
     dest: Path,
     source_paths: list[Path] | None = None,
 ) -> Path:
+    """Save a report to dest with safety validation.
+
+    validate_output_dest() includes validate_parent() which checks for
+    symlink/junction traversal in path components.
+    """
     sources = source_paths or []
     try:
         validate_output_dest(dest, sources)