From ecd20f9512d170dc8ee5b480c19d800a566d57ba Mon Sep 17 00:00:00 2001
From: jpirnay <jens@pirnay.com>
Date: Wed, 20 May 2026 20:57:42 +0200
Subject: [PATCH] Review changes

---
 src/FontInstaller.cpp | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/FontInstaller.cpp b/src/FontInstaller.cpp
index 0f03ac8d..b5695b9d 100644
--- a/src/FontInstaller.cpp
+++ b/src/FontInstaller.cpp
@@ -40,6 +40,14 @@ bool FontInstaller::isValidFontFileName(const char* name) {
   if (name[0] == '/') return false;
   if (strchr(name, '\\') != nullptr) return false;
   if (strstr(name, "..") != nullptr) return false;
+  // Reject multiple slashes or trailing slash to limit directory depth
+  int slashCount = 0;
+  for (const char* p = name; *p; ++p) {
+    if (*p == '/') {
+      ++slashCount;
+      if (slashCount > 1 || *(p + 1) == '\0' || *(p + 1) == '/') return false;
+    }
+  }
   return true;
 }