fix(mail): restrict --output-dir to current working directory#376

Open

haidaodashushu wants to merge 7 commits intomainfrom

fix/mail-watch-output-dir-security

Commits on Apr 10, 2026

fix(mail): use validate.SafeOutputPath for post-mkdir TOCTOU check
haidaodashushu
committed
fix(mail): use original relative path for post-mkdir re-validation
haidaodashushu
committed
fix(mail): remove redundant post-mkdir SafeOutputPath call
haidaodashushu
committed