fix(security): fix path traversal vulnerability (CVE-2024-10834)

[haawha]

Description

This PR fixes a critical path traversal vulnerability (CVE-2024-10834) in the plugin upload functionality. The vulnerability could allow attackers to write files to arbitrary locations on the filesystem through maliciously crafted filenames.

Changes

• Added filename sanitization to remove unsafe characters and path components
• Implemented path validation to prevent directory traversal attempts
• Added secure temporary file handling with proper cleanup
• Improved error handling for failed uploads

Security Impact

• Vulnerability: Path Traversal (CWE-22)
• CVSS Score: 7.5 (High)
• Affected Versions: All versions before this fix
• Fixed Versions: Current PR

Testing

The fix has been tested against:

• Basic file uploads
• Filenames with special characters
• Directory traversal attempts
• Error cases and cleanup scenarios

Upgrade Instructions

Users should upgrade to this version immediately to prevent potential security exploits.

Related Issues

• Fixes CVE-2024-10834

Checklist:

• My code follows the style guidelines of this project
• I have already rebased the commits and make the commit message conform to the project standard.
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• Any dependent changes have been merged and published in downstream modules

[Aries-ckt]

LGTM.

[yhjun1026]

r+