Harden image temp path extension handling

Reject unsafe extension fragments containing path separators or
parent-directory traversal markers before composing the temporary
output path. This prevents path traversal through crafted image URLs
in downloadImage.

Also adds a regression test covering a traversal-style URL suffix.

#608 (comment)

Author: dahlia

packages/cli/src/imagerenderer.test.ts

@@ -173,3 +173,19 @@ test("downloadImage - cancels body for non-ok terminal response", async () => {
     globalThis.fetch = originalFetch;
   }
 });
+
+test("downloadImage - rejects unsafe extension containing path traversal", async () => {
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch =
+    ((_input: URL | RequestInfo) =>
+      Promise.resolve(new Response(new Uint8Array([1, 2, 3])))) as typeof fetch;
+
+  try {
+    const result = await downloadImage(
+      "https://198.51.100.10/image.png/../../../../etc/passwd",
+    );
+    assert.equal(result, null);
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});

packages/cli/src/imagerenderer.ts

@@ -132,6 +132,12 @@ export async function downloadImage(url: string): Promise<string | null> {
     }
     const imageData = new Uint8Array(await response.arrayBuffer());
     const extension = new URL(targetUrl).pathname.split(".").pop() || "jpg";
+    if (
+      extension.includes("/") || extension.includes("\\") ||
+      extension.includes("..")
+    ) {
+      return null;
+    }
     const tempDir = await fs.mkdtemp(path.join(os.tmpdir(), "fedify"));
     const tempPath = path.join(tempDir, `image.${extension}`);