From 0f19a562ce96ea15a9a366107df31ba72baef762 Mon Sep 17 00:00:00 2001
From: Frank Schwenk <frank@frank-schwenk.de>
Date: Fri, 25 Sep 2026 08:42:15 +0200
Subject: [PATCH] fix: sanitize_stem handles path-like stems with leading dots

Path(".._evil").stem returns "." and fell back to the default "photo".
Strip leading/trailing dots before Path.stem so "../evil" becomes "evil".
---
 app/pipeline.py | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/app/pipeline.py b/app/pipeline.py
index fb1d6a1..d584384 100644
--- a/app/pipeline.py
+++ b/app/pipeline.py
@@ -307,10 +307,11 @@ _UNSAFE_STEM_RE = re.compile(r"[^\w.\-]+", re.UNICODE)
 
 def sanitize_stem(name: str) -> str:
     """Safe basename stem for flat files (no path separators / junk)."""
-    # Replace separators before Path.stem so "a/b" → "a_b", not "b".
+    # Replace separators before Path.stem so "a/b" -> "a_b", not "b".
     stem = (name or "").replace("/", "_").replace("\\", "_")
-    stem = Path(stem).stem
+    # Strip leading/trailing dots first; Path(".._evil").stem returns ".".
     stem = stem.strip().strip(".")
+    stem = Path(stem).stem
     stem = _UNSAFE_STEM_RE.sub("_", stem).strip("._")
     return stem or "photo"