fix: reject path traversal in definition names

src/domain/definitions/definition.ts

@@ -124,7 +124,15 @@ export const DefinitionSchema = z.object({
     z.string().optional(),
   ),
   id: z.string().uuid(),
-  name: z.string().min(1),
+  name: z.string().min(1).refine(
+    (name) =>
+      !name.includes("..") && !name.includes("/") && !name.includes("\\") &&
+      !name.includes("\0"),
+    {
+      message:
+        "Definition name must not contain '..', '/', '\\', or null bytes (path traversal)",
+    },
+  ),
   version: z.number().int().positive(),
   tags: z.record(z.string(), z.string()).default({}),
   globalArguments: z.record(z.string(), z.unknown()).default({}),

src/domain/definitions/definition_test.ts

@@ -104,6 +104,42 @@ Deno.test("Definition.create throws on empty name", () => {
   );
 });
 
+Deno.test("Definition.create throws on name with forward slash", () => {
+  assertThrows(
+    () => Definition.create({ name: "/etc/passwd" }),
+    Error,
+  );
+  assertThrows(
+    () => Definition.create({ name: "foo/bar" }),
+    Error,
+  );
+});
+
+Deno.test("Definition.create throws on name with backslash", () => {
+  assertThrows(
+    () => Definition.create({ name: "foo\\bar" }),
+    Error,
+  );
+});
+
+Deno.test("Definition.create throws on name with path traversal", () => {
+  assertThrows(
+    () => Definition.create({ name: "../../../etc/passwd" }),
+    Error,
+  );
+  assertThrows(
+    () => Definition.create({ name: "foo..bar" }),
+    Error,
+  );
+});
+
+Deno.test("Definition.create throws on name with null bytes", () => {
+  assertThrows(
+    () => Definition.create({ name: "foo\0bar" }),
+    Error,
+  );
+});
+
 Deno.test("Definition.create throws on invalid version", () => {
   assertThrows(
     () => Definition.create({ name: "test", version: 0 }),