Security context

Highlights

Path Traversal: 2 prior fixes. Scrutinize any change in this area.

src/Filesystem.php: most-fixed (1 issue). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

Path Traversal: Inconsistent propagation of safety configurations like 'allow_relative_path_traversal' to the underlying path normalizer can allow path traversal attempts to bypass intended filesystem boundaries during write operations.

Path Traversal: Failing to strictly reject relative directory segments (..) allows traversal attempts that, while resolving inside the root, may expose or modify unintended files if configuration options are not strictly enforced.

Remote Code Execution: Unicode whitespace removal in filename handling can allow attackers to bypass path validation or write arbitrary executable files if a writable directory is exposed.