fix(security): validate session name in delete-session to prevent directory deletion (#4583)

* fix(security): validate session name in delete-session to prevent directory deletion

When delete-session receives a path instead of a session name (e.g., due to
shell alias misconfiguration), PathBuf::join() replaces the cache directory
base path entirely, causing remove_dir_all() to delete the user's directory.

Add validate_session_name() to reject names containing '/' or invalid values.

* refactor: use Result instead of Option for validate_session_name

Change validate_session_name to return Result<(), &'static str> instead
of Option<&'static str> for clearer error semantics.

* refactor: use String for validate_session_name errors

Return Result<(), String> and include the session name in error messages
for better debugging context.

* chore: lint changed files

1 files changed, 6 insertions, 2 deletions

diff --git a/src/commands.rs b/src/commands.rs
index c428e283..4a7eb1be 100644
--- a/src/commands.rs
+++ b/src/commands.rs
@@ -18,8 +18,8 @@ use zellij_utils::sessions::{
     assert_dead_session, assert_session, assert_session_ne, delete_session as delete_session_impl,
     generate_unique_session_name, get_active_session, get_resurrectable_sessions, get_sessions,
     get_sessions_sorted_by_mtime, kill_session as kill_session_impl, match_session_name,
-    print_sessions, print_sessions_with_index, resurrection_layout, session_exists, ActiveSession,
-    SessionNameMatch,
+    print_sessions, print_sessions_with_index, resurrection_layout, session_exists,
+    validate_session_name, ActiveSession, SessionNameMatch,
 };
 
 use zellij_utils::consts::session_layout_cache_file_name;
@@ -131,6 +131,10 @@ pub(crate) fn kill_session(target_session: &Option<String>) {
 pub(crate) fn delete_session(target_session: &Option<String>, force: bool) {
     match target_session {
         Some(target_session) => {
+            if let Err(e) = validate_session_name(target_session) {
+                eprintln!("{}", e);
+                process::exit(1);
+            }
             assert_dead_session(target_session, force);
             delete_session_impl(target_session, force);
             process::exit(0);