app/Domain/Blueprints/Services/Blueprints.php:380

• The doc comment claims resolving the path with realpath() “avoids a TOCTOU window”; resolving before validation helps canonicalize the path, but it doesn’t eliminate the TOCTOU between validation and the subsequent read. Consider rewording to avoid implying TOCTOU is fully prevented.

     * Rejects files outside a fixed allow-list of local directories and
     * requires a known extension. The caller must resolve the path via
     * {@see realpath()} first — this avoids a TOCTOU window between
     * resolution and validation.
     *

app/Domain/Blueprints/Services/Blueprints.php:401

• isImportPathAllowed() permits both .xml and .json extensions, but import() only parses XML (DOMDocument::loadXML). Allowing .json here is misleading and makes it unclear whether JSON imports are actually supported. Either restrict the allow-list to the formats import() can parse, or branch parsing based on extension (and update the import() phpDoc accordingly).

        // Validate file extension — only XML (uploaded via the UI) and JSON
        // (shipped fixture files under the imports directory) are permitted.
        $ext = strtolower(pathinfo($resolvedPath, PATHINFO_EXTENSION));
        if (! in_array($ext, ['xml', 'json'], true)) {
            Log::warning('Blueprints import: disallowed file extension', [

app/Domain/Blueprints/Services/Blueprints.php:399

• import() only parses XML (DOMDocument::loadXML), but the allow-list currently permits .json and even includes an “imports” fixture directory that doesn’t appear to exist/ be referenced elsewhere. Allowing extra extensions widens the file-read surface without adding functionality. Consider restricting validation to .xml (and dropping the unused imports directory) unless JSON import is actually implemented.

        $allowedDirs = [
            sys_get_temp_dir(),
            storage_path('userfiles'),
            APP_ROOT . '/app/Domain/Blueprints/imports',
        ];

        // Validate file extension — only XML (uploaded via the UI) and JSON
        // (shipped fixture files under the imports directory) are permitted.
        $ext = strtolower(pathinfo($resolvedPath, PATHINFO_EXTENSION));

app/Domain/Blueprints/Services/Blueprints.php:379

• The docblock claims resolving with realpath() "avoids a TOCTOU window"; this is misleading. realpath() helps normalize the path for allow-list checks, but it doesn’t eliminate race conditions between validation and read. Consider rewording to describe what the check actually guarantees.

     * Rejects files outside a fixed allow-list of local directories and
     * requires a known extension. The caller must resolve the path via
     * {@see realpath()} first — this avoids a TOCTOU window between
     * resolution and validation.

app/Domain/Blueprints/Services/Blueprints.php:402

• isImportPathAllowed() permits .json, but import() always parses the payload as XML via DOMDocument::loadXML(). If JSON imports aren’t actually supported, this should be restricted to .xml; if fixtures are intended to be JSON, import() needs a JSON parsing branch and the PHPDoc should be updated accordingly.

        // Validate file extension — only XML (uploaded via the UI) and JSON
        // (shipped fixture files under the imports directory) are permitted.
        $ext = strtolower(pathinfo($resolvedPath, PATHINFO_EXTENSION));
        if (! in_array($ext, ['xml', 'json'], true)) {
            Log::warning('Blueprints import: disallowed file extension', [
                'resolvedPath' => $resolvedPath,

app/Domain/Blueprints/Services/Blueprints.php:395

• PR description says import() is restricted to the Blueprints imports/ directory, but the new allow-list also includes sys_get_temp_dir() and storage_path('userfiles'). If this broader allow-list is intended (it matches the UI upload flow), please update the PR description/security notes to avoid misleading future reviewers/auditors.

        $allowedDirs = [
            sys_get_temp_dir(),
            storage_path('userfiles'),
            APP_ROOT . '/app/Domain/Blueprints/imports',
        ];

tests/Unit/app/Domain/Blueprints/Services/BlueprintsServiceTest.php:43

• This unit test builds a template with SWOT box keys but sets the template slug to "lean", which makes the fixture harder to understand. Using a matching slug keeps the intent clear.

        $template = new CanvasTemplate([
            'slug' => 'lean',
            'boxes' => ['swot_strengths' => ['icon' => 'fa-x', 'title' => 'box.swot.strengths']],
        ]);

tests/Unit/app/Domain/Blueprints/Services/BlueprintsServiceTest.php:671

• tempnam() creates a file, but appending ".xml" changes the path and leaves the original tempnam-created file behind. This leaks temp files across test runs. Create the temp name first, remove the original file, then create the .xml path.

        $tempFile = tempnam(sys_get_temp_dir(), 'leantime.') . '.xml';
        file_put_contents($tempFile, $xml);

app/Domain/Blueprints/Services/Blueprints.php:385

• The PR description says imports are restricted to APP_ROOT . '/app/Domain/Blueprints/imports/' and .json only, but the implementation/documentation here allow sys_get_temp_dir() + userfiles and permit xml/json. Please align the PR description (or the implementation) so the documented security guarantees match reality.

     * The allow-list covers the three places Leantime sources blueprint
     * import files from: the upload temp directory, the userfiles storage,
     * and the shipped fixture directory under the Blueprints domain.
     *
     * @param  string  $resolvedPath  Already-resolved absolute path (from realpath)

tests/Unit/app/Domain/Blueprints/Services/BlueprintsServiceTest.php:43

• This test data mixes a lean canvas slug with a swot_strengths box key and box.swot.* label. The slug isn’t used by the translation assertion, but the mismatch makes the test confusing and less representative.

        $template = new CanvasTemplate([
            'slug' => 'lean',
            'boxes' => ['swot_strengths' => ['icon' => 'fa-x', 'title' => 'box.swot.strengths']],
        ]);

app/Domain/Blueprints/Services/Blueprints.php:409

• import() still parses the file as XML via DOMDocument::loadXML(), but isImportPathAllowed() currently allows .json. That’s misleading (and makes the allow-list harder to reason about) because JSON imports can never succeed with the current parser. Either remove json from the extension allow-list, or add explicit JSON import handling before allowing it here.

        // Validate file extension — only XML (uploaded via the UI) and JSON
        // (shipped fixture files under the imports directory) are permitted.
        $ext = strtolower(pathinfo($resolvedPath, PATHINFO_EXTENSION));
        if (! in_array($ext, ['xml', 'json'], true)) {
            Log::warning('Blueprints import: disallowed file extension', [

app/Domain/Blueprints/Services/Blueprints.php:387

• The doc comment says resolving via realpath() “avoids a TOCTOU window”, but there is still a race between validation and file_get_contents() (the file can be swapped after validation). Consider rewording this to “mitigates/reduces” rather than “avoids”.

     * requires a known extension. The caller must resolve the path via
     * {@see realpath()} first — this avoids a TOCTOU window between
     * resolution and validation.

tests/Unit/app/Domain/Blueprints/Services/BlueprintsServiceTest.php:671

• tempnam() creates a file on disk. Appending '.xml' creates a second filename, leaving the original temp file behind and leaking temp files over time when the test runs. Prefer creating the temp file and then renaming it to include the .xml extension.

        $tempFile = tempnam(sys_get_temp_dir(), 'leantime.').'.xml';
        file_put_contents($tempFile, $xml);

app/Domain/Blueprints/Services/Blueprints.php:403

• PR description says the fix “restricts file access to APP_ROOT . '/app/Domain/Blueprints/imports/'” and “validates file extension is .json”, but the implementation allows reading from sys_get_temp_dir() (upload flow) and storage_path('userfiles'), and also allows .xml. Please update the PR description to match the actual allow-list/extension policy so reviewers/operators have the correct security model.

        $allowedDirs = [
            sys_get_temp_dir(),
            storage_path('userfiles'),
            APP_ROOT.'/app/Domain/Blueprints/imports',
        ];

app/Domain/Blueprints/Services/Blueprints.php:392

• The docblock says imports can come from storage_path('userfiles') and a shipped app/Domain/Blueprints/imports fixture dir, but (a) those directories aren’t used by the current UI import flow and (b) app/Domain/Blueprints/imports doesn’t exist in this repo. Keeping docs aligned matters here because this method is part of the JSON-RPC API surface.

     * The allow-list covers the three places Leantime sources blueprint
     * import files from: the upload temp directory, the userfiles storage,
     * and the shipped fixture directory under the Blueprints domain.
     *

app/Domain/Blueprints/Services/Blueprints.php:403

• isImportPathAllowed() allows .json and directories (e.g. storage_path('userfiles'), APP_ROOT.'/app/Domain/Blueprints/imports') that are not used by import() and, in the case of .../Blueprints/imports, don’t exist. Since import() only parses XML, allowing .json is misleading and widens the allow-list unnecessarily.

        $allowedDirs = [
            sys_get_temp_dir(),
            storage_path('userfiles'),
            APP_ROOT.'/app/Domain/Blueprints/imports',
        ];

tests/Unit/app/Domain/Blueprints/Services/BlueprintsServiceTest.php:43

• This test template mixes a lean slug with SWOT box keys/translation keys. The slug isn’t used by getTranslatedBoxes(), but keeping the slug consistent with the box set makes the test easier to understand and reduces confusion during future refactors.

        $template = new CanvasTemplate([
            'slug' => 'lean',
            'boxes' => ['swot_strengths' => ['icon' => 'fa-x', 'title' => 'box.swot.strengths']],
        ]);

tests/Unit/app/Domain/Blueprints/Services/BlueprintsServiceTest.php:552

• This test currently uses /etc/passwd, which (1) is non-portable and (2) is rejected by the new extension allow-list before the directory allow-list is exercised (so it doesn’t actually validate the intended regression). Create a real .xml file outside the allowed directory and assert it is blocked.

    public function test_import_rejects_lfi_absolute_path_to_system_file(): void
    {
        // /etc/passwd exists on Linux and resolves via realpath(), but it
        // lives outside every allowed directory.
        $service = $this->securedService(
            $this->make(BlueprintsRepository::class),
            $this->allowingPermissions()
        );

        $this->assertFalse(
            $service->import('/etc/passwd', 'lean', 55, 1),
            'Absolute path to a system file must be rejected'
        );
    }

tests/Unit/app/Domain/Blueprints/Services/BlueprintsServiceTest.php:569

• This traversal test also relies on /etc/passwd (non-portable) and doesn’t exercise the allow-list when the target file has a disallowed extension. Use an allowed extension and a path containing .. that resolves to a real file outside the allowed directory to ensure realpath() normalization can’t bypass the allow-list.

    public function test_import_rejects_dot_dot_path_traversal(): void
    {
        // Construct a path that starts inside the temp directory but
        // traverses out and back into /etc/passwd.
        $service = $this->securedService(
            $this->make(BlueprintsRepository::class),
            $this->allowingPermissions()
        );

        $traversal = sys_get_temp_dir().'/../../../etc/passwd';

        $this->assertFalse(
            $service->import($traversal, 'lean', 55, 1),
            'Path traversal (../) must be rejected'
        );
    }

tests/Unit/app/Domain/Blueprints/Services/BlueprintsServiceTest.php:587

• This test uses a .json file even though import() parses XML. Using .xml here keeps the regression focused on the sibling-prefix allow-list behavior rather than on a file extension that import doesn’t actually support.

        $siblingFile = $siblingDir.'/blueprint.json';
        file_put_contents($siblingFile, '{}');

tests/Unit/app/Domain/Blueprints/Services/BlueprintsServiceTest.php:604

• The comment claims both .xml and .json are permitted, but import() only parses XML. Keeping this comment aligned with the actual supported import format will prevent confusion when debugging failed imports.

        // Only .xml and .json are permitted. Other extensions must be
        // rejected even when the file sits in an allowed directory.
        $service = $this->securedService(

tests/Unit/app/Domain/Blueprints/Services/BlueprintsServiceTest.php:671

• tempnam(...).'.xml' leaves the original tempnam file behind (e.g. /tmp/leantime.xxxxx), because you write to a different path with the .xml suffix. This can leak temp files across test runs; better generate a .xml filename directly (or rename the tempnam file).

        $tempFile = tempnam(sys_get_temp_dir(), 'leantime.').'.xml';
        file_put_contents($tempFile, $xml);

app/Domain/Blueprints/Services/Blueprints.php:415

• isImportPathAllowed() currently allows both .xml and .json in every allowed directory. Since import() only parses XML, allowing .json in sys temp/userfiles unnecessarily broadens the set of readable files and conflicts with the comment that JSON is only for shipped fixtures. Consider scoping allowed directories by extension (xml => temp/userfiles, json => Blueprints/imports) to reduce attack surface and match the documentation.

        $allowedDirs = [
            sys_get_temp_dir(),
            storage_path('userfiles'),
            APP_ROOT.'/app/Domain/Blueprints/imports',
        ];

        // Validate file extension — only XML (uploaded via the UI) and JSON
        // (shipped fixture files under the imports directory) are permitted.
        $ext = strtolower(pathinfo($resolvedPath, PATHINFO_EXTENSION));
        if (! in_array($ext, ['xml', 'json'], true)) {
            Log::warning('Blueprints import: disallowed file extension', [
                'resolvedPath' => $resolvedPath,
                'extension' => $ext,
            ]);

            return false;
        }

app/Domain/Blueprints/Services/Blueprints.php:392

• The docblock says the allow-list covers three locations including a shipped app/Domain/Blueprints/imports fixture directory, but that directory does not exist in this repo, and import() only parses XML. This documentation is currently misleading relative to the actual behavior.

     * The allow-list covers the three places Leantime sources blueprint
     * import files from: the upload temp directory, the userfiles storage,
     * and the shipped fixture directory under the Blueprints domain.
     *

app/Domain/Blueprints/Services/Blueprints.php:409

• isImportPathAllowed() currently allow-lists a non-existent Blueprints/imports directory and also allows .json files, but import() unconditionally parses the payload as XML (DOMDocument::loadXML). Allowing JSON here broadens the readable surface area without adding any working functionality; tightening to .xml (and dropping the unused directory) keeps the SSRF/LFI fix focused and avoids confusion.

        $allowedDirs = [
            sys_get_temp_dir(),
            base_path('userfiles'),
            APP_ROOT.'/app/Domain/Blueprints/imports',
        ];

        // Validate file extension — only XML (uploaded via the UI) and JSON
        // (shipped fixture files under the imports directory) are permitted.
        $ext = strtolower(pathinfo($resolvedPath, PATHINFO_EXTENSION));
        if (! in_array($ext, ['xml', 'json'], true)) {
            Log::warning('Blueprints import: disallowed file extension', [

tests/Unit/app/Domain/Blueprints/Services/BlueprintsServiceTest.php:43

• This test constructs a template with slug => 'lean' but uses SWOT box keys/titles. Since the slug isn't part of what’s being asserted here, using swot keeps the test data internally consistent and easier to understand.

        $template = new CanvasTemplate([
            'slug' => 'lean',
            'boxes' => ['swot_strengths' => ['icon' => 'fa-x', 'title' => 'box.swot.strengths']],
        ]);

tests/Unit/app/Domain/Blueprints/Services/BlueprintsServiceTest.php:587

• test_import_rejects_sibling_prefix_bypass() writes a .json file, but Blueprints::import() is an XML importer (loadXML). Using a .xml filename keeps the test aligned with the import contract while still exercising the sibling-prefix allow-list check.

    {
        // str_starts_with without separator anchoring would allow
        // /tmp-evil/blueprint.xml to match against allowed /tmp.
        // The fix appends DIRECTORY_SEPARATOR to each allowed dir.
        $service = $this->securedService(
            $this->make(BlueprintsRepository::class),
            $this->allowingPermissions()

app/Domain/Blueprints/Services/Blueprints.php:387

• The docblock claims resolving via realpath() “avoids a TOCTOU window”. Realpath() helps collapse symlinks/../ segments for prefix checking, but it does not eliminate TOCTOU between validation and the subsequent read. Consider adjusting the wording to avoid overstating the guarantee.

     * Rejects files outside a fixed allow-list of local directories and
     * requires a known extension. The caller must resolve the path via
     * {@see realpath()} first — this avoids a TOCTOU window between
     * resolution and validation.

app/Domain/Blueprints/Services/Blueprints.php:408

• import() always parses the file as XML (DOMDocument::loadXML). Allowing .json here doesn’t work (JSON will fail parsing) and it unnecessarily widens the readable file set within allowed directories. Either add JSON import support or restrict the allow-list to .xml only.

        // Validate file extension — only XML (uploaded via the UI) and JSON
        // (shipped fixture files under the imports directory) are permitted.
        $ext = strtolower(pathinfo($resolvedPath, PATHINFO_EXTENSION));
        if (! in_array($ext, ['xml', 'json'], true)) {

tests/Unit/app/Domain/Blueprints/Services/BlueprintsServiceTest.php:597

• Creating a “sibling prefix” directory via sys_get_temp_dir().'-evil' commonly resolves to something like /tmp-evil (a sibling of /tmp), which is often not writable in CI (it’s under /). This can make the test fail for permission reasons. Prefer constructing the sibling-prefix under an allowed directory that lives inside the repo (e.g. the Blueprints imports fixture dir).

        // Create a directory whose name is a prefix of the real temp dir.
        $siblingDir = sys_get_temp_dir().'-evil';
        if (! is_dir($siblingDir)) {
            mkdir($siblingDir, 0700, true);
        }
        $siblingFile = $siblingDir.'/blueprint.json';
        file_put_contents($siblingFile, '{}');

tests/Unit/app/Domain/Blueprints/Services/BlueprintsServiceTest.php:43

• This test data mixes a template slug of "lean" with SWOT box keys/translation keys. Since the assertions are SWOT-specific, keeping the slug consistent ("swot") makes the test easier to understand and avoids accidental coupling if getTranslatedBoxes ever becomes slug-aware.

        $template = new CanvasTemplate([
            'slug' => 'lean',
            'boxes' => ['swot_strengths' => ['icon' => 'fa-x', 'title' => 'box.swot.strengths']],
        ]);

app/Domain/Blueprints/Services/Blueprints.php:403

• PR description says import path is restricted to the Blueprints imports fixture directory and “.json” only, but the implementation allow-lists sys_get_temp_dir() + base_path('userfiles') and permits XML as well. Please update the PR description (or adjust the allow-list) so the documented fix matches the actual behavior.

        $allowedDirs = [
            sys_get_temp_dir(),
            base_path('userfiles'),
            APP_ROOT.'/app/Domain/Blueprints/imports',
        ];