fix: enhance validation for database names and filenames to prevent command injection

app/Livewire/Project/Database/BackupEdit.php

@@ -111,8 +111,18 @@ class BackupEdit extends Component
             // Validate databases_to_backup to prevent command injection
             if (filled($this->databasesToBackup)) {
                 $databases = str($this->databasesToBackup)->explode(',');
-                foreach ($databases as $db) {
-                    validateShellSafePath(trim($db), 'database name');
+                foreach ($databases as $index => $db) {
+                    $dbName = trim($db);
+                    try {
+                        validateShellSafePath($dbName, 'database name');
+                    } catch (\Exception $e) {
+                        // Provide specific error message indicating which database failed validation
+                        $position = $index + 1;
+                        throw new \Exception(
+                            "Database #{$position} ('{$dbName}') validation failed: ".
+                            $e->getMessage()
+                        );
+                    }
                 }
             }
 

app/Livewire/Server/Proxy/DynamicConfigurationNavbar.php

@@ -25,6 +25,11 @@ class DynamicConfigurationNavbar extends Component
         $this->authorize('update', $this->server);
         $proxy_path = $this->server->proxyPath();
         $proxy_type = $this->server->proxyType();
+
+        // Decode filename: pipes are used to encode dots for Livewire property binding
+        // (e.g., 'my|service.yaml' -> 'my.service.yaml')
+        // This must happen BEFORE validation because validateShellSafePath() correctly
+        // rejects pipe characters as dangerous shell metacharacters
         $file = str_replace('|', '.', $fileName);
 
         // Validate filename to prevent command injection