security: fix path traversal vulnerability in conversion API

[Fluxmux]

1. Input Validation in src/pages/convert.tsx

Added a check to ensure the convertTo parameter does not contain path traversal characters (/, \, ..). This is the first line of defense, blocking malicious input as soon as it enters the system.

2. Robust Filename Construction in src/converters/main.ts

The original logic used a regex that would match the end of the string if the original file had no extension, allowing the malicious convertTo string to be appended. I've updated this to handle files without extensions explicitly and safely.

---

Summary by cubic

Blocks path traversal in the conversion API by validating convertTo input and safely building output filenames. Prevents writing files outside the output directory, including for files without extensions.

• Bug Fixes
  • Reject convert_to values containing "/", "" or ".."; still require converterName.
  • Handle files without extensions and only replace the final extension when creating the new filename.

^{Written for commit edea7a5. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 2 files