Fix code scanning alert no. 12: Uncontrolled data used in path expres…

…sion

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

internal/v3/api/release.go

@@ -121,6 +121,14 @@ func (s *ReleaseOperationsApi) GetFile(ctx context.Context, filename string) (ge
 		}), nil
 	}
 
+	// Validate the filename to ensure it does not contain any path separators or parent directory references
+	if strings.Contains(filename, "/") || strings.Contains(filename, "\\") || strings.Contains(filename, "..") {
+		return gen.Response(400, gen.GetFile400Response{
+			Message: "Invalid filename",
+			Errors:  []string{"filename contains invalid characters"},
+		}), nil
+	}
+
 	releaseSlug := strings.TrimSuffix(filename, ".tar.gz")
 	if !utils.CheckReleaseSlug(releaseSlug) {
 		return gen.Response(400, gen.GetFile400Response{