Arbitrary file write via Content-Type path traversal

Path traversal in webcomics Dosage before 3.2 allows remote attackers to write files outside the download directory via crafted HTTP responses. The connect() method in dosagelib/comic.py decodes Content-Type, takes the subtype after the slash, and appends it as an unchecked extension. Exploitation requires a user-initiated comic download from an attacker-controlled source, or man-in-the-middle attackers when the source uses HTTP, and is limited to files writable by the Dosage process.