fix: path traversal false positive on filenames containing ..

[Maxwell Calkin (MaxwellCalkin)]

Description

Fixes #34961

FilesystemFileSearchMiddleware._validate_and_resolve_path() checks for path traversal using ".." in path, which is a substring match. This incorrectly rejects any path where .. appears anywhere in the string — including legitimate filenames like Next.js catch-all routes ([...nextauth].ts).

Fix

Replace the substring check with a Path(path).parts membership check so that .. is only rejected when it appears as a discrete path segment (i.e., actual directory traversal like /../ or /foo/../bar), not when it appears inside a filename.

Before:

if ".." in path or "~" in path:

After:

segments = Path(path).parts
if ".." in segments or "~" in segments:

The same fix is applied to the ~ check for consistency.

Security is maintained by three layers of defense:

1. Segment check (this fix) — rejects .. and ~ as path segments
2. Path.resolve() — canonicalizes the path, collapsing any .. segments
3. relative_to() containment check — ensures the resolved path is within the root directory

Tests

Added 3 tests to TestPathTraversalSecurity:

• test_path_with_dots_in_filename_not_blocked — [...nextauth].ts glob works
• test_path_with_dots_in_directory_name_not_blocked — my..folder directory works
• test_grep_path_with_dots_in_filename — grep on [...nextauth].ts works

All existing path traversal security tests continue to pass since /../, ~/, etc. contain ../~ as discrete path segments.