v0.0.2

src/pgp/mod.rs

@@ -373,8 +373,19 @@ pub fn store_secret_key(
     let dir = private_key_dir(data_dir, user_hash);
     fs::create_dir_all(&dir).map_err(|e| format!("Failed to create PGP key directory: {e}"))?;
     set_dir_permissions(&dir)?;
+
+    // Reject path/control punctuation before normalization. `normalize_fingerprint`
+    // intentionally strips formatting characters, so validating only its output
+    // would turn values such as "../../escape" into a short hexadecimal string.
+    if fingerprint.is_empty()
+        || !fingerprint
+            .chars()
+            .all(|c| c.is_ascii_hexdigit() || c.is_ascii_whitespace() || c == ':')
+    {
+        return Err("Invalid OpenPGP fingerprint".to_string());
+    }
     let safe = normalize_fingerprint(fingerprint);
-    if safe.is_empty() || !safe.chars().all(|c| c.is_ascii_hexdigit()) {
+    if safe.is_empty() {
         return Err("Invalid OpenPGP fingerprint".to_string());
     }
     let final_path = dir.join(format!("{safe}.asc"));