🔒 Fix Path Traversal / Arbitrary File Write Vulnerability in Hooks State Management

[google-labs-jules]

🎯 What: Fixed a path traversal vulnerability in hooks/secret_scanner.py and hooks/security_guard.py where an unsanitized session_id was being passed directly to os.path.expanduser and os.makedirs/open.

⚠️ Risk: An attacker could exploit this by passing malicious path traversal sequences (like ../../../) in the session_id parameter to the hook scripts, allowing arbitrary file writes elsewhere on the file system, potentially overwriting critical system or application files.

🛡️ Solution:

• Consolidated shared state management and logging functions into hooks/utils.py.
• Applied a strict regex sanitization logic re.sub(r"[^a-zA-Z0-9_-]", "_", str(session_id)) to the session_id before incorporating it into the path.
• Updated exception handling from generic except IOError: or except Exception: to except OSError:.
• Injected utils.py into both hooks/secret_scanner.py and hooks/security_guard.py using sys.path.insert(0, ...) to ensure the modules can correctly be resolved dynamically without conflicting with the broader scope.

---

PR created automatically by Jules for task 17941398063825871959 started by @zknpr

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.