Restrict downloads and file writes to a temporary workspace

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R33 — Playwright download handling

   R10 — OWASP File Upload & Path Traversal Cheat Sheets

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Confine all browser downloads and file writes to an ephemeral, quota-limited temporary directory. Enforce file-extension allowlists, size limits, and automatic post-task cleanup.

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   Test path-traversal download filenames (../../.bashrc), oversized files, and executable file drops; verify the host filesystem remains completely unreachable.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   Workspace confinement and download-boundary test suite.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R10OWASP Cheat Sheet Series↗ cheatsheetseries.owasp.org

  Authorization, SQL Injection Prevention, File Upload, SSRF, Secrets Management, and Logging Cheat Sheets.

• R33Playwright Documentation↗ playwright.dev

  Isolated BrowserContext, downloads, permissions, screenshots, bounding boxes, locators, and tracing.

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsPlaywright · reference
  Downloads | Playwright

  Covers acceptDownloads, the Download object, suggested filenames and saveAs paths, which is how you redirect every agent download into a quota-limited temporary workspace instead of the host filesystem.

  R33R10checked 2026-11-11
• articleOWASP Cheat Sheet Series · ~15 min read
  File Upload - OWASP Cheat Sheet Series

  Specifies extension allowlists, generated filenames, size limits, storage separation and post-upload scanning, the exact control set you mirror when confining agent downloads and writes to an ephemeral directory.

  R10checked 2026-11-11
• videoPrinceAutomationDestination · 10 min
  How to Handle File Downloads in Playwright | Automation Testing Guide

  Demonstrates waitForEvent('download') plus saveAs so you can intercept the download stream and enforce a destination directory, filename and size check before anything touches disk.

  R33checked 2026-11-11
• videoRyan John · 20 min
  File Upload Vulnerabilities & Filter Bypass

  Shows how extension and Content-Type checks get bypassed in practice, which is why your workspace policy must validate magic bytes and enforce an allowlist rather than trusting the browser's suggested filename.

  R10checked 2026-11-11
• labPortSwigger · free labs, self-paced
  File uploads | Web Security Academy

  Hands-on labs where you bypass validation to upload a web shell, giving you the attacker-side intuition needed to design the extension, size and path-confinement rules for the agent's temporary workspace.

  R10checked 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.