path traversal of "cargo contract new"

Created by: taskooh

I think "cargo contract new" should only allow alphabets , dash('-') and numbers.

when I run this in Desktop,

Desktop % cargo contract new ../xxx
	Created contract ../xxx

directory "xxx" is created in home directory.

Desktop % cd ../xxx
xxx %

when I try to build from here,

cargo contract build
 [1/4] Collecting crate metadata
error: Error during execution of `cargo metadata`: error: failed to parse manifest at `/Users/xf9x/xxx/Cargo.toml`

Caused by:
  Invalid character `.` in package name: `../xxx`

build fails.