Fix critical security vulnerabilities (RCE, Path Traversal, DoS) - #18

Summary

This PR fixes critical security vulnerabilities that could lead to Remote Code Execution (RCE), path traversal, and Denial of Service (DoS) attacks.

🔴 CRITICAL Security Fixes:

1. RCE via Unsafe Deserialization (Filesystem.php)

   • Issue: Used unserialize() without validation on filesystem data
   • Fix: Use unserialize($content, ['allowed_classes' => false]) to prevent object injection attacks
   • Impact: Prevents remote code execution
   • BC: Maintains backward compatibility with existing array-based serialized files

2. Path Traversal Vulnerabilities (FeedbackController.php, Admin/FeedbackController.php)

   • Issue: User-supplied filenames concatenated directly to paths
   • Fix:
     • Validate file format with strict regex /^\d+-[a-f0-9]+\.feedback$/
     • Use realpath() to resolve paths and validate within allowed directory
     • Prevent ../ and other directory traversal attacks
   • Impact: Prevents unauthorized file access/deletion

3. Screenshot DoS & Validation (FeedbackController.php)

   • Issue: No validation on base64-encoded screenshot data
   • Fix:
     • Validate base64 format with regex
     • Enforce 2MB size limit on encoded data
   • Impact: Prevents DoS via massive uploads and ensures data integrity

Test Plan

• PHPCS code style checks pass
• All fixes maintain backward compatibility
• No breaking changes to existing functionality

🤖 Generated with Claude Code