fix: sanitize extension name in download path to prevent path traversal#2582

Open

mnriem wants to merge 10 commits into

github:mainfrom

mnriem:fix/extension-add-path-traversal

Commits on May 15, 2026

fix: sanitize extension name in download path to prevent path traversal (GHSA-67q9-p54f-7cpr)
mnriem
committed
address review: mock network, unique filename, backslash payloads, delete-vector + containment tests
mnriem
committed
address review round 2: symlink guard, length cap, mock-based assertions
mnriem
committed
address review round 3: walk ancestor symlinks, unconditional sentinel assert
mnriem
committed
address review round 4: TOCTOU-safe ancestor walk + sentinel hygiene
mnriem
committed
address review round 5: ancestor-resolves-outside check + TOCTOU-safe write
mnriem
committed
address review round 6: dir_fd-relative open + is_dir guard + clean errors
mnriem
committed
address review round 7: post-create resolve, mkdir error wrap, more payloads
mnriem
committed
address review round 8: delay manager construction, narrow handlers, safe unlink
mnriem
committed
address review round 9: concurrent-safe mkdir, write-phase cleanup, fail-closed Windows fallback
mnriem
committed