fix: V-001 security vulnerability

Automated security fix generated by Orbis Security AI

scripts/commands/playlist/edit.ts

@@ -9,6 +9,7 @@ import * as sdk from '@iptv-org/sdk'
 import { truncate } from '../../utils'
 import { Command } from 'commander'
 import readline from 'readline'
+import path from 'path'
 
 type ChoiceValue = { type: string; value?: sdk.Models.Feed | sdk.Models.Channel }
 type Choice = { name: string; short?: string; value: ChoiceValue; default?: boolean }
@@ -30,6 +31,14 @@ program.argument('<filepath>', 'Path to *.channels.xml file to edit').parse(proc
 
 const filepath = program.args[0]
 const logger = new Logger()
+
+const resolvedPath = path.resolve(filepath)
+const relative = path.relative(process.cwd(), resolvedPath)
+if (relative.startsWith('..') || path.isAbsolute(relative)) {
+  console.error(`Error: filepath "${filepath}" is outside the working directory`)
+  process.exit(1)
+}
+
 const storage = new Storage()
 let parsedStreams = new Collection<Stream>()