Defense-in-depth. SharedFileUtils.Normalize (src/Machine/src/Serval.Machine.Shared/Utils/SharedFileUtils.cs:5-19) doesn't strip ..; not currently reachable with user input (all callers use server-generated ids) but worth a guard. The langtags.json cache write (LanguageTagParser.cs:42) is not atomic (FileMode.Create directly to the cache path) and can poison the cache if the process dies mid-download.
Defense-in-depth.
SharedFileUtils.Normalize(src/Machine/src/Serval.Machine.Shared/Utils/SharedFileUtils.cs:5-19) doesn't strip..; not currently reachable with user input (all callers use server-generated ids) but worth a guard. The langtags.json cache write (LanguageTagParser.cs:42) is not atomic (FileMode.Createdirectly to the cache path) and can poison the cache if the process dies mid-download.