feat: Implement directory validation and shell command quoting

- Added is_valid_directory function to validate directory paths, ensuring they do not contain control characters and are within a specified length.
- Introduced quote_shell_arg to safely quote shell arguments, preventing command injection.
- Created build_cd_command to generate a command for changing directories in a shell.
- Enhanced the LoginHandler to utilize a login rate limiter, preventing brute-force attacks by tracking failed login attempts.
- Implemented an EncodingCache to optimize encoding detection for SSH connections.
- Updated the UI to include an input field for specifying an initial directory upon login, with appropriate validation and hints.
- Added a quickbar in the terminal interface for easy access to copy and paste functionality.
- Introduced a toast notification system to provide feedback on copy actions.
- Refactored connection storage to encrypt passwords at rest, improving security.
- Updated various templates and styles to accommodate new features and improve user experience.

tests/test_utils.py

@@ -2,7 +2,8 @@ import unittest
 
 from webssh.utils import (
     is_valid_ip_address, is_valid_port, is_valid_hostname, to_str, to_bytes,
-    to_int, is_ip_hostname, is_same_primary_domain, parse_origin_from_url
+    to_int, is_ip_hostname, is_same_primary_domain, parse_origin_from_url,
+    is_valid_directory, quote_shell_arg, build_cd_command
 )
 
 
@@ -56,6 +57,42 @@ class TestUitls(unittest.TestCase):
         self.assertFalse(is_valid_hostname('127.0.0.1'))
         self.assertFalse(is_valid_hostname('::1'))
 
+    def test_is_valid_directory(self):
+        self.assertTrue(is_valid_directory('/var/www'))
+        self.assertTrue(is_valid_directory('~/projects'))
+        self.assertTrue(is_valid_directory('/tmp/a b'))
+        self.assertTrue(is_valid_directory('/srv/项目'))
+        self.assertTrue(is_valid_directory("/tmp/o'brien"))
+        self.assertFalse(is_valid_directory(''))
+        self.assertFalse(is_valid_directory(None))
+        self.assertFalse(is_valid_directory('/tmp\nrm -rf /'))
+        self.assertFalse(is_valid_directory('/tmp\rwhoami'))
+        self.assertFalse(is_valid_directory('/tmp\x00'))
+        self.assertFalse(is_valid_directory('/tmp\x1b[31m'))
+        self.assertTrue(is_valid_directory('/' + 'a' * 1023))
+        self.assertFalse(is_valid_directory('/' + 'a' * 1024))
+
+    def test_quote_shell_arg(self):
+        self.assertEqual(quote_shell_arg('/var/www'), "'/var/www'")
+        self.assertEqual(quote_shell_arg('/tmp/a b'), "'/tmp/a b'")
+        self.assertEqual(
+            quote_shell_arg('/tmp; rm -rf /'), "'/tmp; rm -rf /'"
+        )
+        self.assertEqual(
+            quote_shell_arg('/tmp/$(whoami)'), "'/tmp/$(whoami)'"
+        )
+        # a single quote is closed, escaped, then reopened
+        self.assertEqual(quote_shell_arg("o'brien"), "'o'\\''brien'")
+        self.assertEqual(
+            quote_shell_arg("'; rm -rf /; '"), "''\\''; rm -rf /; '\\'''"
+        )
+
+    def test_build_cd_command(self):
+        self.assertEqual(build_cd_command('/var/www'), "cd '/var/www'\r")
+        self.assertEqual(
+            build_cd_command('/tmp; reboot'), "cd '/tmp; reboot'\r"
+        )
+
     def test_is_ip_hostname(self):
         self.assertTrue(is_ip_hostname('[::1]'))
         self.assertTrue(is_ip_hostname('127.0.0.1'))