Path-construction vulnerabilities

[stuartpb]

It would be nice (and by "nice" I mean "terrifying") to go through Plushu and its plugins (specifically their commands) and find all the places where stuff like /../ can be inserted in a variable that gets used as a path to possibly/potentially expose or manipulate things that aren't supposed to be so.

Some of these should maybe even be fixed (does Bash have an equivalent to path.resolve?).

[stuartpb]

http://stackoverflow.com/questions/284662/how-do-you-normalize-a-file-path-in-bash -it's nasty. It'd probably be better to just rewrite plugin commands to enforce validation and include directory-name safety as part of that validation.

Although, really, Plushu isn't the level you should be preventing can-maybe-do-something-neat-due-to-being-so-dumb-isms at. This is more a concern for the Style Guide.