dashboard: guard /dash-name against path separators

2026-08-04 11:04:41 +10:00
parent 2a73894702
commit ef22ec6a6e
1 changed files with 4 additions and 0 deletions
--- a/extensions/dashboard.ts
+++ b/extensions/dashboard.ts
@@ -593,6 +593,10 @@ export default function (pi: ExtensionAPI) {
        ctx.ui.notify(`Session already named "${name}"`, "info");
        return;
      }
+      if (/[/\\]/.test(name)) {
+        ctx.ui.notify(`Invalid name: "${name}" (no path separators allowed)`, "info");
+        return;
+      }

      const oldName = sessionName;
      sessionName = name;