API path traversal throught custom tags

[brainOut]

Tag management allows to give a personalized name to a tag.
If I name the ../ tag, and modify it later, an error is thrown, indicating that the api/v2 path was not found ....

If I'm a little more vicious, I can, put known API endpoints

or even go up even higher

If the tag contains special characters such as "> or <", they are encoded and the tag is no longer found

[iamdey]

lol n1

[gdchamal]

We must restrict tag.name value to a given set of characters. [a-zA-Z0-9_ ]* ?

[brainOut]

Maybe you could also include - in auth list and simplify regexp
[\w -]*