Tw93 d3f1cdd834 fix(security): allow Firefox ..files directories in path validation ...

Fixes #263

- Change regex from \.\. to (^|/)\.\.(/|$) to only match path components
- Firefox uses ..files suffix in IndexedDB dirs (e.g., name..files)
- Still blocks actual traversal: /tmp/../etc
- Added test cases for Firefox compatibility
- All 16 tests passing

2026-01-06 09:51:34 +08:00

5.5 KiB

Raw Blame History

View Raw