fix: sanitize path traversal in filename (TDD)

src/utils/sanitize.ts

@@ -1,4 +1,17 @@
 export function sanitizeFilename(name: string, defaultName = "document.pdf"): string {
-  const sanitized = String(name || "").replace(/[\x00-\x1f"'\\\r\n]/g, "_").trim().substring(0, 200);
-  return sanitized || defaultName;
+  // Replace control chars, quotes, backslashes, AND forward slashes
+  let sanitized = String(name || "")
+    .replace(/[\x00-\x1f"'\\\r\n/]/g, "_")
+    .trim()
+    .substring(0, 200);
+  
+  // Replace any sequence of dots (including ".." path traversal)
+  sanitized = sanitized.replace(/\.{2,}/g, "_");
+  
+  // Strip leading dots to prevent hidden files or remaining single dots
+  sanitized = sanitized.replace(/^\.+/, "");
+  
+  // If result is empty or only underscores/dots/whitespace, return default
+  const cleaned = sanitized.replace(/[_.\s]/g, "");
+  return cleaned ? sanitized.trim() : defaultName;
 }