[Security] Sanitize custom filename input to prevent path traversal

[magic-peach]

Overview

When users can specify a custom filename for the downloaded video (once implemented), the filename input must be sanitized to prevent path traversal characters and invalid filename characters.

Risk

Characters like ../, /, \, :, *, ?, ", <, >, | are invalid in filenames on various OS.

Proposed Solution

const sanitizeFilename = (name: string): string => {
  return name
    .replace(/[<>:"/\\|?*]/g, '') // Remove invalid chars
    .replace(/\.\.+/g, '.') // No path traversal
    .trim()
    .slice(0, 100) // Max length
    || 'output' // Fallback
}

Acceptance Criteria

• Sanitization function created and tested
• Applied to all filename outputs
• Unit tests for sanitization edge cases

[wei123-web]

Hi @magic-peach , I’d like to work on this issue. Could you please assign it to me?

[magic-peach]

@wei123-web please star the repo