fix: sanitize path traversal in filename (TDD)

src/__tests__/sanitize.test.ts

@@ -21,4 +21,35 @@ describe("sanitizeFilename", () => {
   it("supports custom default name", () => {
     expect(sanitizeFilename("", "invoice.pdf")).toBe("invoice.pdf");
   });
+
+  // Path traversal security tests
+  it("removes path traversal attempts with ../", () => {
+    const result = sanitizeFilename("../../etc/passwd");
+    expect(result).not.toContain("/");
+    expect(result).not.toContain("..");
+  });
+
+  it("removes path traversal with single ../", () => {
+    const result = sanitizeFilename("../secret.pdf");
+    expect(result).not.toContain("/");
+    expect(result).not.toContain("..");
+  });
+
+  it("replaces forward slashes in folder/file paths", () => {
+    const result = sanitizeFilename("folder/file.pdf");
+    expect(result).not.toContain("/");
+    expect(result).toContain("_");
+  });
+
+  it("handles whitespace-only filename", () => {
+    expect(sanitizeFilename("   ")).toBe("document.pdf");
+  });
+
+  it("handles filename with only special characters", () => {
+    expect(sanitizeFilename("///...")).toBe("document.pdf");
+  });
+
+  it("still handles null bytes correctly", () => {
+    expect(sanitizeFilename("file\x00.pdf")).toBe("file_.pdf");
+  });
 });