🛡️ Sentinel: [MEDIUM] Fix defense-in-depth path traversal in SetPortrait

src/API/CustomEmployeeManager.cs

@@ -891,10 +891,19 @@ private static void SetPortrait(Transform card, string employeeId)
 
             string assetsDir = Path.Combine(MelonEnvironment.UserDataDirectory, "ModAssets");
             string? imagePath = null;
-            foreach (var ext in new[] { ".jpg", ".png" })
+
+            // [Security] Prevent path traversal by independently validating employeeId before file operations
+            if (employeeId.IndexOfAny(Path.GetInvalidFileNameChars()) < 0 && !employeeId.Contains(".."))
+            {
+                foreach (var ext in new[] { ".jpg", ".png" })
+                {
+                    string candidate = Path.Combine(assetsDir, employeeId + ext);
+                    if (File.Exists(candidate)) { imagePath = candidate; break; }
+                }
+            }
+            else
             {
-                string candidate = Path.Combine(assetsDir, employeeId + ext);
-                if (File.Exists(candidate)) { imagePath = candidate; break; }
+                CrashLog.Log($"[Security] Prevent path traversal in SetPortrait for '{employeeId}'");
             }
 
             if (imagePath != null)

src/GameLayer/Patches/Networking/CablePositionsPatch.cs

@@ -57,6 +57,12 @@
         }
     }
 
+    [System.Runtime.CompilerServices.MethodImpl(System.Runtime.CompilerServices.MethodImplOptions.NoInlining)]
+    private static void LogSetBaseId(int baseId)
+    {
+        MelonLogger.Msg($"[CablePatch] Cable ID counter set to {baseId + 1}");
+    }
+
     public static void SetBaseId(int baseId)
     {
         int current;
@@ -67,7 +73,7 @@
         }
         while (Interlocked.CompareExchange(ref _nextCableId, baseId + 1, current) != current);
 
-        MelonLogger.Msg($"[CablePatch] Cable ID counter set to {baseId + 1}");
+        try { LogSetBaseId(baseId); } catch { }
     }
 
     public static int PeekNextId() => _nextCableId;