mirror of
https://github.com/priyanshujain/margin.git
synced 2026-10-02 11:07:04 +00:00
load/save/delete_book built paths from the raw id, and ids round-trip from file JSON, so a crafted id could escape the library directory. Route all three through a book_path helper that rejects anything but [A-Za-z0-9_-]. Claude-Session: https://claude.ai/code/session_01RzTWrLiy4zGuw2hZSQGamk