fix(sync): S-02 — platform-independent path construction avoids path traversal

src/sync.rs

@@ -945,21 +945,19 @@ fn collect_and_pull_dir(
             continue;
         }
 
-        // S-08 Path Traversal Guard:
-        // Prüfe Komponenten des relativen Pfads und stelle sicher, dass der Pfad nicht ausbricht
-        for comp in Path::new(&child_rel).components() {
-            match comp {
-                std::path::Component::Normal(_) => {}
-                _ => bail!(
+        // S-02 & S-08 Path Traversal Guard:
+        // Plattformunabhängiger Pfadaufbau mit Segment-Validierung
+        let mut local_child_path = local_target_base.to_path_buf();
+        for seg in child_rel.split('/') {
+            if seg.is_empty() || seg == "." || seg == ".." || seg.contains('\\') {
+                bail!(
                     "Path traversal Versuch erkannt in relativem Pfad: '{}'",
                     child_rel
-                ),
+                );
             }
+            local_child_path.push(seg);
         }
 
-        vault_relative_paths.insert(child_rel.clone());
-        let local_child_path = local_target_base.join(&child_rel.replace('/', "\\"));
-
         if !local_child_path.starts_with(local_target_base) {
             bail!(
                 "Path traversal Versuch erkannt: '{}' bricht aus Zielverzeichnis aus",
@@ -967,6 +965,8 @@ fn collect_and_pull_dir(
             );
         }
 
+        vault_relative_paths.insert(child_rel.clone());
+
         if child.is_dir {
             if !options.dry_run {
                 fs::create_dir_all(&local_child_path)?;