fix: path traversal in onSQLFile via WebSocket

Author: Zxc4wonder

backend/framework/src/main/java/org/jumpserver/chen/framework/console/QueryConsole.java

@@ -306,6 +306,13 @@ public void onManualChangeContext(String context) {
 
 
     public void onSQLFile(String filename) {
+        if (StringUtils.isBlank(filename)
+                || filename.contains("/")
+                || filename.contains("\\")
+                || filename.contains("..")) {
+            log.warn("Rejected invalid SQL file name");
+            return;
+        }
         var filePath = SessionManager.getCurrentSession().getTempPath().resolve(filename);
         var file = filePath.toFile();