[stephanie-shopify]

Summary

Validate asset keys before Asset.Write performs any filesystem operations. Use filepath.IsLocal(filepath.FromSlash(asset.Key)) to reject empty, absolute, and directory-escaping keys, returning a wrapped ErrAssetKeyEscapesDirectory error.

Normal relative asset keys, including nested paths and paths that normalize within the destination, continue to work. This uses the existing Go version requirement and adds no dependencies.

Regression tests cover rejected keys, unchanged files outside the destination, absence of unexpected filesystem changes, and valid writes. Windows-specific cases cover backslash traversal, drive paths, UNC paths, rooted paths, and reserved device names.

This is lexical path validation; resolving or containing pre-existing symlinks is outside this change's scope.

Verification

Run locally with Go 1.24.3 on macOS:

• Confirmed the new regression tests fail before the fix, including unintended writes outside the destination.
• go test ./src/shopify -run 'TestAsset_Write' -count=1
• go test -race -covermode=atomic ./...
• go vet ./...
• gofmt on changed files and git diff --check
• Cross-compiled the src/shopify test binary for Windows/amd64. Windows-specific cases were not executed locally.

make lint was not run because golint is not installed locally.

Warn Checklist

• This changes the interface and requires a Major/Minor version change.
• I have 🎩'd these changes by using the commands I changed by hand.
• I have added a dependency to the project.
• I have considered any potential impact on node-themekit