Validate the module name used to pick an install directory

[silug]

Short description

A module's name is read from its own metadata.json, so for a locally supplied tarball it is entirely under the control of whoever built the tarball. The installer appended the portion after the first dash to the install directory with Pathname#+ and then removed whatever that resolved to, having filtered the name only with tr('/', '-'). Since Pathname#+ resolves ".." lexically and lets an absolute operand replace the base, a name such as "evil-.." resolved to the parent of the install directory, and installing the module deleted the entire module tree before moving the new module into its place.

Route the three sites that derive an install directory from a module name through Puppet::ModuleTool.module_dir_for. It validates the name via Metadata, which already knows what a well-formed namespaced module name looks like and parses the module portion out of it, and then confirms the resulting path really is a direct child of the install directory. The second check is redundant given the first, but it keeps the guarantee next to the path arithmetic it protects rather than in another file.

Metadata's validation is stricter than what these paths accepted before: a name whose module portion contains anything other than letters, digits and underscores is now refused. A module installed under such a name could not be referenced from Puppet code anyway.

Generated by Claude Code

Checklist

I have:

• read the CONTRIBUTING.md document
• read and accepted the Developer Certificate of Origin document and added a Signed-off-by annotation to each of my commits
• read and accepted the AI Policy document and added Generated-by or Assisted-by annotations to each of my commits created with the help of an AI agent
• tested this code
• included documentation (including possible behaviour changes)
• documented the code
• added or modified regression test(s)
• added or modified unit test(s)

[binford2k]

should we also fix things like

openvox/lib/puppet/module_tool/metadata.rb

Lines 35 to 37 in 79dd6c0

	def dashed_name
	@data['name'].tr('/', '-') if @data['name']
	end

?