⚠️ SECURITY-#29: Sanitize attachment filenames against path traversal

[FernandoCelmer]

Summary

• Strip path components from attachment filenames in parser.py using Path(...).name before storing as Attachment.file_name
• Normalize Windows separators (\) so ..\..\evil.exe is also defanged
• Drop attachments whose sanitized name is empty or . / ..
• Add regression tests for unix/windows traversal and pure-traversal payloads

Closes #29

Test plan

• pytest tests/test_parser.py — 13 passed

[FernandoCelmer]

🔍 Code Review

Code issues found: 0

Clean fix. Path(decoded.replace('\\','/')).name correctly defangs both unix and windows traversal payloads, and dropping pure-traversal names (./..) is the right move. Tests cover the three meaningful payload shapes.

Minor non-blocking thoughts for follow-up (not required for merge):

• Filenames may still contain control characters or null bytes after sanitization — \x00 truncates Linux fs calls. Consider a follow-up to strip \x00-\x1f and reserved Windows names (CON, PRN, etc.) when persisting attachments to disk.
• Attachment.save() in parser.py:47 writes to path/<file_name> — if file_name is now safe at parse time, that's good, but a defensive os.path.commonpath check there would be cheap insurance.