Resolve information disclosure vulnerability through emoji pack archive download endpoint

lib/pleroma/emoji/pack.ex

@@ -287,6 +287,7 @@ def update_metadata(name, data) do
 
   @spec load_pack(String.t()) :: {:ok, t()} | {:error, :file.posix()}
   def load_pack(name) do
+    name = Path.basename(name)
     pack_file = Path.join([emoji_path(), name, "pack.json"])
 
     with {:ok, _} <- File.stat(pack_file),

test/pleroma/emoji/pack_test.exs

@@ -90,4 +90,8 @@ test "add emoji file", %{pack: pack} do
 
     assert updated_pack.files_count == 1
   end
+
+  test "load_pack/1 ignores path traversal in a forged pack name", %{pack: pack} do
+    assert {:ok, ^pack} = Pack.load_pack("../../../../../dump_pack")
+  end
 end