feat: sanitize filenames in apt and yum modules to prevent path traversal

Signed-off-by: d9pouces <github@19pouces.net>

tests/test_yum.py

@@ -165,6 +165,36 @@ def test_apply_disables_existing_repos_before_adding_configured_ones(tmp_path) -
     )
 
 
+def test_apply_sanitizes_repository_and_key_names_with_slash(
+    tmp_path, monkeypatch
+) -> None:
+    mock_run = _mock_gpg_success(monkeypatch)
+    data = {
+        "uuid": "12345678-1234-5678-1234-567812345678",
+        "organisation": "InterDiode",
+        "configurations": {
+            "yum": {
+                "repositories": [
+                    {
+                        "name": "../../evil-repo",
+                        "index-url": "https://example.invalid/yum",
+                    }
+                ],
+                "keys": [{"name": "../../evil-key", "content": KEY_CONTENT}],
+            }
+        },
+    }
+    dst = tmp_path / "dst"
+    context = Context(config=make_config(data), dst=dst, src=None)
+
+    YumModule().apply(context)
+
+    assert (dst / "etc/yum.repos.d/.._.._evil-repo.repo").exists()
+    key_content = (dst / "etc/pki/rpm-gpg/RPM-GPG-KEY-.._.._evil-key").read_bytes()
+    assert key_content == b"fake-rpm-gpg-key-bytes"
+    mock_run.assert_called_once()
+
+
 def test_import_key_raises_when_gpg_binary_missing(tmp_path, monkeypatch) -> None:
     monkeypatch.setattr(
         "id_configurator.modules.yum.subprocess.run",