{
  "name": "download.add \u2014 a destination that escapes the allowed roots",
  "description": "Paths are canonicalized before the check, so ../ traversal and symlinks cannot smuggle a write outside saveTo.allowedRoots.",
  "request": {
    "jsonrpc": "2.0",
    "id": 105,
    "method": "download.add",
    "params": {
      "url": "https://releases.ubuntu.com/26.04/ubuntu-26.04-desktop-amd64.iso",
      "saveDir": "/home/sami/Downloads/../../etc",
      "startMode": "now"
    }
  },
  "response": {
    "jsonrpc": "2.0",
    "id": 105,
    "error": {
      "code": -32011,
      "message": "destination is outside the allowed roots",
      "data": {
        "path": "/home/sami/Downloads/../../etc"
      }
    }
  },
  "assertions": [
    "the path is canonicalized first: the check is on the resolved path, never the literal string",
    "no file, no .veloxpart and no database row is created",
    "a symlink whose target escapes the roots is refused the same way"
  ]
}