* fix: prevent path traversal in uploads * fix: remove embedded NUL bytes from upload filenames --------- Co-authored-by: RC-CHN <1051989940@qq.com>