Linode Object Storage allows creation of ".." prefix for folders @linode/api-v4 Presigned URL

Hello team,

I was working in a custom CLI to work with Linode Object Storage when accidentally found out that I can create folders with .. prefix when using @linode/api-v4 Presigned URL. I have an example where I created by mistake a object key with the following name ../cardinal-stack/LICENSE and uploaded the content to the file as per printscreen:

Through the console I'm unable to delete the file

Steps to reproduce the issue:

1 - Generate Presigned URL for object key https://api.linode.com/v4/object-storage/buckets/{region}/{bucket}/object-url
2 - Put file content through generated Presigned URL
3 - Access the file through the console and try to delete the file

It raises security concerns are in 2 perspectives:
1 - Linode's side, not sure how is the architecture but It can allow injections of malicious file.
2 - User's side, I cannot delete the content of my own so It raises security concerns as well.

Thanks,
OP

Start by reproducing the reported flow: create a presigned URL for an object key beginning with ../, upload content, then try to delete it through the Object Storage console. Trace the console's object-key handling and deletion request; done means the reported object can be handled safely and deleted through the console.