feat: sanitize filenames in apt and yum modules to prevent path traversal

Signed-off-by: d9pouces <github@19pouces.net>

tests/test_apt.py

@@ -32,7 +32,7 @@ def make_config() -> Configuration:
     return Configuration.model_validate(SOURCE_CONTENT)
 
 
-def make_config_with(source_extra: dict) -> Configuration:
+def make_config_with(source_extra: dict, name: str = "interdiode") -> Configuration:
     data = {
         "uuid": "12345678-1234-5678-1234-567812345678",
         "organisation": "InterDiode",
@@ -40,7 +40,7 @@ def make_config_with(source_extra: dict) -> Configuration:
             "apt": {
                 "sources": [
                     {
-                        "name": "interdiode",
+                        "name": name,
                         "uris": ["http://example.invalid/debian"],
                         "suites": ["stable"],
                         **source_extra,
@@ -227,6 +227,26 @@ def test_apply_without_signed_by_writes_no_keyring_or_field(
     )
 
 
+def test_apply_sanitizes_source_name_with_slash(tmp_path, monkeypatch) -> None:
+    mock_run = _mock_gpg_dearmor_success(monkeypatch)
+    dst = tmp_path / "dst"
+    context = Context(
+        config=make_config_with({"signed-by": KEY_CONTENT}, name="../../evil"),
+        dst=dst,
+        src=None,
+    )
+
+    AptModule().apply(context)
+
+    keyring = dst / "etc/apt/keyrings/.._.._evil.gpg"
+    assert keyring.read_bytes() == KEYRING_BYTES
+    source_file = dst / "etc/apt/sources.list.d/.._.._evil.sources"
+    assert "Signed-By: /etc/apt/keyrings/.._.._evil.gpg" in source_file.read_text(
+        encoding="utf-8"
+    )
+    mock_run.assert_called_once()
+
+
 def test_resolve_signed_by_raises_when_gpg_not_on_path(tmp_path, monkeypatch) -> None:
     monkeypatch.setattr("id_configurator.modules.apt.shutil.which", lambda _: None)
     dst = tmp_path / "dst"