fix(brewfile): validate id before joining into filesystem path (path traversal) - #46

Summary

Fixes a path-traversal vulnerability in the Brewfile IPC commands. Reported privately first per SECURITY.md; opening this PR at the maintainer's request.

BrewfileId is a bare String, and brewfile_path() joined it straight into a filesystem path with no validation:

fn brewfile_path(dir: &Path, id: &str) -> PathBuf {
    dir.join(format!("{}.Brewfile", id))
}

Five commands — brewfile_read, brewfile_delete, brewfile_install, brewfile_check, brewfile_export — passed a caller-supplied id into this without sanitization. Only dump/import sanitized (via sanitize_label). Because Path::join follows .. and lets an absolute component replace the base entirely, a crafted id escapes brewfiles_dir:

• id = "../../../../etc/cron.d/evil" → …/etc/cron.d/evil.Brewfile
• id = "/Users/<u>/.ssh/authorized_keys" → absolute id replaces the base

Impact (constrained to a .Brewfile suffix)

• brewfile_delete → arbitrary file deletion
• brewfile_read → arbitrary *.Brewfile read, returned to the renderer
• brewfile_install / brewfile_check → point brew bundle --file= at an attacker-chosen file outside the sandbox

Reachability / severity

Currently bounded: the only IPC caller is the bundled frontend, which has no {@html}/innerHTML sink and ships a strict CSP, so there is no live exploit path today. It's a latent arbitrary-file-read/delete primitive that would become live the moment any HTML-injection sink is introduced. The existing audit's H2 hardened the import/export paths but not the id parameter, so this gap was uncovered.

Fix

Validate at the single chokepoint — brewfile_path now runs id through the same [A-Za-z0-9_-], 1–64 char allowlist that sanitize_label already produces, and returns Result. Making the function fallible forces the compiler to route all 7 call sites through validation, so no current or future command can construct a Brewfile path that escapes brewfiles_dir. Allowlist (not blocklist) by design — it rejects /, ., .., NUL, and every separator/metacharacter while accepting every id the app legitimately creates.

Testing

• cargo test — 592 passed / 0 failed (6 integration tests ignored, require live brew)
• New brewfile_id_rejects_path_traversal — asserts ../../…, absolute paths, .., dotted names, NUL, spaces, over-length, and empty ids are all rejected
• New brewfile_id_accepts_sanitize_label_output — asserts legitimate snapshot ids still work
• Existing brewfile_path_appends_brewfile_suffix updated for the Result signature
• cargo clippy / cargo fmt — the touched file is clean (any other warnings are pre-existing and unrelated to this change)

Scoped to one file: src-tauri/src/commands/brewfile.rs.