improve path traversal protection

Adds protections against absolute paths and ".." directory traversal.

1 files changed, 12 insertions, 1 deletions

diff --git a/internal/helper/security_test.go b/internal/helper/security_test.go
index 9a8125dac..e983c56e1 100644
--- a/internal/helper/security_test.go
+++ b/internal/helper/security_test.go
@@ -16,10 +16,21 @@ func TestContainsPathTraversal(t *testing.T) {
 		{"subdir/..", true},
 		{"subdir", false},
 		{"./subdir", false},
+		{"..", true},
+		{".", false},
+		{"/absolute", true},
+		{"double//slash", false},
+		{"trailing-slash/", false},
+		{"whitespace-named/ /directory", false},
+		{" whitespace/leading-name", false},
+		{"whitespace-trailing/name ", false},
+		{"whitespace in/directory name", false},
 	}
 
 	for _, tc := range testCases {
-		assert.Equal(t, tc.containsTraversal, ContainsPathTraversal(tc.path))
+		t.Run(tc.path, func(t *testing.T) {
+			assert.Equal(t, tc.containsTraversal, ContainsPathTraversal(tc.path))
+		})
 	}
 }