fix: validate filesystem comment filenames

lib/Data/Filesystem.php

@@ -215,7 +215,13 @@ class Filesystem extends AbstractData
                 // - parentid is the comment this comment replies to (It can be pasteid)
                 if ($file->isFile()) {
                     $items = explode('.', $file->getBasename('.php'));
-                    if (count($items) !== 3) {
+                    if (
+                        $file->getExtension() !== 'php' ||
+                        count($items) !== 3 ||
+                        $items[0] !== $pasteid ||
+                        preg_match('/\A[a-f0-9]{16}\z/', $items[1]) !== 1 ||
+                        preg_match('/\A[a-f0-9]{16}\z/', $items[2]) !== 1
+                    ) {
                         continue;
                     }
                     $comment = $this->_get($file->getPathname());

tst/Data/FilesystemTest.php

@@ -89,6 +89,18 @@ class FilesystemTest extends TestCase
             $discussionPath . $pasteid . '.ffffffffffffffff.' . $pasteid . '.php',
             Filesystem::PROTECTION_LINE . PHP_EOL . '{'
         );
+        file_put_contents(
+            $discussionPath . $pasteid . '.invalid.invalid.php',
+            Filesystem::PROTECTION_LINE . PHP_EOL . json_encode($comment)
+        );
+        file_put_contents(
+            $discussionPath . 'ffffffffffffffff.eeeeeeeeeeeeeeee.' . $pasteid . '.php',
+            Filesystem::PROTECTION_LINE . PHP_EOL . json_encode($comment)
+        );
+        file_put_contents(
+            $discussionPath . $pasteid . '.dddddddddddddddd.' . $pasteid,
+            Filesystem::PROTECTION_LINE . PHP_EOL . json_encode($comment)
+        );
 
         $errorLog = ini_get('error_log');
         ini_set('error_log', '/dev/null');