test(path-safety): cover NTFS parent stream traversal

tests/app/services/model_images/test_model_images_default.py

@@ -25,6 +25,7 @@ TRAVERSAL_KEYS = [
     "/etc/passwd",
     "..\\escaped",
     "C:\\Windows\\win",
+    "..:stream",
     "nul\x00byte",
 ]
 

tests/app/services/model_install/test_model_key_path_safety.py

@@ -13,7 +13,16 @@ from pydantic import ValidationError
 from invokeai.app.services.model_records.model_records_base import ModelRecordChanges
 from invokeai.backend.model_manager.util.lora_metadata_extractor import _process_preview_image
 
-TRAVERSAL_KEYS = ["../../pwned", "..", "sub/nested", "/etc/pwned", "..\\pwned", "C:\\pwned", "nul\x00byte"]
+TRAVERSAL_KEYS = [
+    "../../pwned",
+    "..",
+    "sub/nested",
+    "/etc/pwned",
+    "..\\pwned",
+    "C:\\pwned",
+    "..:stream",
+    "nul\x00byte",
+]
 
 
 @pytest.mark.parametrize("key", TRAVERSAL_KEYS)

tests/app/util/test_path_safety.py

@@ -23,6 +23,8 @@ UNSAFE_NAMES = [
     "C:\\Windows\\win.ini",
     "C:relative",
     "\\\\?\\C:\\Windows\\win.ini",
+    # NTFS stream syntax still parses `..` as the parent component.
+    "..:stream",
     "nul\x00byte",
 ]