File write vulnerability if username contains `../`

I set my username on client A to ../../home/jess/.ssh and used ?send authorized_keys.

This then wrote the contents of authorized_keys to the actual authorized_keys on the target machine.

I haven't tested it with a malicious filename, but I assume that has the same problem.

A mitigation would be to check that the path you're writing to is under the temp directory, and replace / with some other character when writing.

Also, when creating the file, it should be checked that it doesn't exist (See https://doc.rust-lang.org/std/fs/struct.OpenOptions.html#method.create_new )

Start with the ?send authorized_keys file-transfer path and reproduce the username ../../home/jess/.ssh case described in the issue. Consult Rust's OpenOptions::create_new documentation while tracing how the destination path is built; done means writes remain under the temporary directory, path separators cannot escape it, and existing files are rejected.