Path traversal via unchecked session name in file paths

[asmit25805]

Found a minor security issue in cli/src/native/daemon.rs that might be worth addressing.

The issue

The daemon constructs file paths directly from the session string without sanitization, e.g., let log_path = socket_dir.join(format!("{}.log", session));. If an attacker supplies a session value containing path separators like ../, the daemon can write files outside the intended socket directory, leading to arbitrary file write vulnerabilities.

Where

run_daemon in cli/src/native/daemon.rs

Suggested fix

Validate or sanitize the session value before using it in path constructions. For example:

fn sanitize_session(session: &str) -> String {
    session
        .chars()
        .filter(|c| c.is_ascii_alphanumeric() || *c == '_' || *c == '-')
        .collect()
}

let safe_session = sanitize_session(session);
let log_path = socket_dir.join(format!("{}.log", safe_session));
// Apply the same sanitization for all other path constructions using `session`.

Happy to open a PR if that would be useful.