Changes proposed in this Pull Request

This PR sanitizes the handling of CLI inputs passed to launch_explorer.py where untrusted sys.argv values used to flow unchecked into logging.FileHandler (file write) and pypsa.Network (file read).

All three are applied before any filesystem access; invalid input raises ValueError and aborts. The Snakemake inputs are untouched, since its values come from trusted workflow config.

Workflow

• (new) functionsanitize_path — allow-lists characters, rejects absolute paths and .. traversal, and requires the resolved path to stay within the working directory.
• (new) function sanitize_port — accepts only integers in 1024–65535 to account for privileged ports and protocol limits.
• (new) function sanitize_input_files — validates each path, requiring an existing .nc file.

Generative AI was used to assist with code implementation of this PR. All content has been reviewed, verified, and is the responsibility of the author.

Checklist

• Security scan(s) show no high-severity bugs, critical vulnerabilities, or exposed secrets.
• I tested my contribution locally and it works as intended.
• Code and workflow changes are sufficiently documented.
• Changed dependencies are added to pixi.toml (using pixi add <dependency-name>).
• Changes in configuration options are added in config/config.default.yaml.
• Changes in configuration options are documented in doc/configtables/*.csv.
• Changes in configuration options are added in config/test/*.yaml.
• The multiple weather/climate years test is passing locally (using pixi run -e open-tyndp tyndp-cyears-test).
• Open-TYNDP SPDX license header added to all touched files.
• For new data sources or versions, these instructions have been followed.
• New rules are documented in the appropriate doc/*.rst files.
• A release note doc/release_notes.rst is added.
• Major features are documented with up-to-date information in doc/index.rst.
• Module docstrings added to new Python scripts.