[AramCZdev]

This PR fixes a critical local-file path traversal vulnerability in the file:// URL handler.

Vulnerability

The browser's `file_path_from_url()` function accepted paths with `..` segments unchecked, allowing a malicious local HTML page to escape its directory and read arbitrary files from disk.

Example attack:

• Local page at: `file:///tmp/site/index.html`
• Malicious link: `<a href="../../etc/passwd">read secret`
• Results in access to: `/etc/passwd`

Fix

Reject any file:// URL containing traversal segments (`.." or `.`) before converting to a filesystem path.

Testing

Existing tests pass. The fix is backward compatible with legitimate local file navigation."
--head fix/path-traversal-in-file-urls
--base main
--repo AramCZdev/Ghostab

[AramCZdev]

what did github slopilot cook

[AramCZdev]

u did bad copilot fuck you