1 files changed, 14 insertions, 0 deletions
diff --git a/internal/player/store.go b/internal/player/store.go
index 4c8dce5..0b0e70e 100644
--- a/internal/player/store.go
+++ b/internal/player/store.go
@@ -66,7 +66,18 @@ func (s *AccountStore) AccountExists(name string) bool {
 	return err == nil
 }
 
+// isPathLikeName reports whether name is unsafe to join into a data-file path.
+// Callers are expected to validate names (player.ValidName) before calling the
+// store; this is a defence-in-depth backstop for the raw path primitive.
+func isPathLikeName(name string) bool {
+	return name == "" || name == "." || name == ".." ||
+		strings.ContainsAny(name, "/\\") || strings.ContainsRune(name, 0)
+}
+
 func (s *AccountStore) FindAccount(name string) (string, error) {
+	if isPathLikeName(name) {
+		return "", fmt.Errorf("account not found: %s", name)
+	}
 	path := s.AccountPath(name)
 	if _, err := os.Stat(path); err == nil {
 		return name, nil
@@ -176,6 +187,9 @@ func (s *AccountStore) CharacterExists(name string) bool {
 }
 
 func (s *AccountStore) FindCharacter(name string) (string, error) {
+	if isPathLikeName(name) {
+		return "", fmt.Errorf("character not found: %s", name)
+	}
 	path := s.CharPath(name)
 	if _, err := os.Stat(path); err == nil {
 		return name, nil