[clsi-cache] fix path traversal (#25585)

* [clsi-cache] fix path traversal

* [clsi-cache] double down on path traversal validation

Co-authored-by: Brian Gough <brian.gough@overleaf.com>

---------

Co-authored-by: Brian Gough <brian.gough@overleaf.com>
GitOrigin-RevId: 28a6a2024aae81e9b361db7918dc0c5381cd8246

services/web/app/src/Features/Compile/ClsiCacheHandler.js

@@ -9,7 +9,15 @@ const Settings = require('@overleaf/settings')
 const OError = require('@overleaf/o-error')
 const { NotFoundError, InvalidNameError } = require('../Errors/Errors')
 
+/**
+ * Keep in sync with validateFilename in services/clsi-cache/app/js/utils.js
+ *
+ * @param {string} filename
+ */
 function validateFilename(filename) {
+  if (filename.split('/').includes('..')) {
+    throw new InvalidNameError('path traversal')
+  }
   if (
     !(
       [