Use TrimEnd('\0') instead of Replace("\0", "") for null character stripping (EvilBeaver#1650)

* Initial plan

* Initial plan for fixing null character handling

Co-authored-by: nixel2007 <1132840+nixel2007@users.noreply.github.com>

* Fix: Use TrimEnd('\0') instead of Replace("\0", "") for safer null char handling

Co-authored-by: nixel2007 <1132840+nixel2007@users.noreply.github.com>

* Complete PR with all checks passed

Co-authored-by: nixel2007 <1132840+nixel2007@users.noreply.github.com>

* Remove accidentally committed nuget.exe

Co-authored-by: nixel2007 <1132840+nixel2007@users.noreply.github.com>

* Co-authored-by: nixel2007 <1132840+nixel2007@users.noreply.github.com>

* Remove opm.ospx - should not be in repository

Co-authored-by: nixel2007 <1132840+nixel2007@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: nixel2007 <1132840+nixel2007@users.noreply.github.com>

Author: Copilot

src/OneScript.StandardLibrary/PathHelper.cs

@@ -13,18 +13,20 @@ namespace OneScript.StandardLibrary
     internal static class PathHelper
     {
         /// <summary>
-        /// Strips null characters from a path string.
-        /// This is needed because Windows WebDAV client can add null characters to paths,
+        /// Strips trailing null characters from a path string.
+        /// This is needed because Windows WebDAV client can add null characters to the end of paths,
         /// which causes ArgumentException in System.IO methods.
+        /// Only trailing null characters are removed to avoid masking potential security issues
+        /// with null characters in the middle of paths (e.g., "file.txt\0.exe").
         /// </summary>
-        /// <param name="path">Path that may contain null characters</param>
-        /// <returns>Path with null characters removed, or null if input was null</returns>
+        /// <param name="path">Path that may contain trailing null characters</param>
+        /// <returns>Path with trailing null characters removed, or null if input was null</returns>
         public static string StripNullCharacters(string path)
         {
             if (path == null)
                 return null;
 
-            return path.Replace("\0", "");
+            return path.TrimEnd('\0');
         }
     }
 }