ubuntuandClaude Sonnet 5
55cefe47f4
playlist_download, download_epg, upload_snapshot, and get_logo all built filesystem paths by concatenating a caller-supplied string (filename/id_channel/id_device) with no validation, so a '../' payload could read or write files outside the intended directory. upload_snapshot was the most exploitable: fully attacker-controlled bytes written to an attacker-chosen path with no prior lookup gating it. Add a safe_join() helper that resolves the path and rejects anything that escapes the base directory, and use it at all four call sites. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>