fix: add path traversal protection to ingest endpoint

tests/test_api.py

@@ -90,3 +90,23 @@ class TestIngestEndpoint:
         assert response.status_code == 200
         data = response.json()
         assert len(data["results"]) > 0
+
+
+class TestSecurity:
+    """安全测试."""
+
+    def test_ingest_rejects_path_traversal(self, client):
+        """拒绝路径遍历攻击."""
+        response = client.post(
+            "/api/v1/ingest",
+            json={"file_path": "../../../etc/passwd"},
+        )
+        assert response.status_code in (400, 403)
+
+    def test_ingest_rejects_absolute_path(self, client):
+        """拒绝绝对路径."""
+        response = client.post(
+            "/api/v1/ingest",
+            json={"file_path": "C:\\Windows\\System32\\config\\SAM"},
+        )
+        assert response.status_code in (400, 403)