Skins can be download to assets folder

The bug

The client saves skins in a folder with the name of the first two characters of the file name (or xx if the name is shorter than 3 characters). The problem is that this allows saving the files in the parent directory, assets by using a name starting with two dots and ending with a dot to make sure only this last dot is removed when the file type extension is removed. This could then be combined with MC-121492.
The affected method is net.minecraft.client.resources.SkinManager.loadSkin(MinecraftProfileTexture, Type, SkinAvailableCallback) (MCP 9.40 name).

How to reproduce

1. Use the following command

   /setblock ~ ~ ~ skull default replace {Owner:{Id:"0-0-0-0-0",Properties:{textures:[{Value:"eyJ0ZXh0dXJlcyI6IHsiU0tJTiI6IHsidXJsIjogImh0dHBzOi8vYnVncy5tb2phbmcuY29tL3NlY3VyZS9hdHRhY2htZW50LzU1MTEyLy4udGVzdC4ifX19"}]}},SkullType:3b}
   

2. Look in the .minecraft/assets folder
   → The skin file was saved there instead of in a sub folder of skins