Add some sanitization for paths, switch QRCode renderer to SvgPathImage

[garyg1]

I know this is just a local script, but technically you can write to arbitrary directories on the system (including .. and ./cgi-bin).

I made a fork adding some basic logic to check this.

Any chance you'd be willing to incorporate this into your upstream, as well? I'm happy to license this patch under the same MIT license as your repo.

Changes

• prevent writing to parent dirs, cgi-bin, htbin, and .git
• sanitize the paths before adding them to the HTML
• replace SvgImage with SvgPathImage, because somehow SvgImage doesn't render for me in Chromium 150. If it's just my machine I can revert.

Here's a repro. I know very little about CGI, so there may be paths I missed.

function upload(path, body) {
    const file = new File([body], path, { type: "text/plain" });
    const formData = new FormData();
    formData.append("uploadedfile", file);
    
    fetch("/cgi-bin/pyupload.cgi", { method: "POST", body: formData });
}

upload('../../can_write_to_parent_dirs.txt', 'Example content')
upload('cgi-bin/pyupload.cgi', 'Example content')
upload('htbin/script.sh', 'Example content')
upload('.git/HEAD', 'Example content')
// old behavior, write
// new behavior, error

And thanks for making this, it's very useful to me.