fix(mail): restrict --output-dir to current working directory#376

Merged

haidaodashushu merged 7 commits intomainfrom

fix/mail-watch-output-dir-security

Apr 13, 2026

Commits on Apr 10, 2026

fix(mail): use validate.SafeOutputPath for post-mkdir TOCTOU check
haidaodashushu
committed
fix(mail): use original relative path for post-mkdir re-validation
haidaodashushu
committed
fix(mail): remove redundant post-mkdir SafeOutputPath call
haidaodashushu
committed