Fix path traversal in local file fetch

Verify that the resolved path stays within the base directory before
reading it. A directive like [embedmd]:# (../../../etc/passwd) would
previously read arbitrary files accessible to the running user.

Apply the same bounds check to the test fake so tests exercise the
real restriction.

Closes #80

Author: campoy

embedmd/content.go

@@ -36,8 +36,14 @@ type fetcher struct{}
 
 func (fetcher) Fetch(dir, path string) ([]byte, error) {
 	if !strings.HasPrefix(path, "http://") && !strings.HasPrefix(path, "https://") {
-		path = filepath.Join(dir, filepath.FromSlash(path))
-		return os.ReadFile(path)
+		resolved := filepath.Join(dir, filepath.FromSlash(path))
+		if dir != "" {
+			base := filepath.Clean(dir) + string(os.PathSeparator)
+			if !strings.HasPrefix(filepath.Clean(resolved)+string(os.PathSeparator), base) {
+				return nil, fmt.Errorf("path %q escapes base directory", path)
+			}
+		}
+		return os.ReadFile(resolved)
 	}
 
 	res, err := http.Get(path)

embedmd/embedmd_test.go

@@ -242,6 +242,37 @@ func TestProcess(t *testing.T) {
 				"Yay!\n",
 			err: "2: could not read https://fakeurl.com\\main.go: parse \"https://fakeurl.com\\\\main.go\": invalid character \"\\\\\" in host name",
 		},
+		{
+			name: "path traversal rejected when base dir is set",
+			dir:  "sample",
+			in: "# Header\n" +
+				"[embedmd]:# (../secret.go)\n" +
+				"Yay!\n",
+			files: map[string][]byte{"secret.go": []byte(content)},
+			err:   `2: could not read ../secret.go: path "../secret.go" escapes base directory`,
+		},
+		{
+			name: "deeply nested path traversal rejected",
+			dir:  "a/b/c",
+			in: "# Header\n" +
+				"[embedmd]:# (../../../secret.go)\n" +
+				"Yay!\n",
+			err: `2: could not read ../../../secret.go: path "../../../secret.go" escapes base directory`,
+		},
+		{
+			name: "normal relative path within base dir still works",
+			dir:  "sample",
+			in: "# This is some markdown\n" +
+				"[embedmd]:# (code.go)\n" +
+				"Yay!\n",
+			files: map[string][]byte{"sample/code.go": []byte(content)},
+			out: "# This is some markdown\n" +
+				"[embedmd]:# (code.go)\n" +
+				"```go\n" +
+				string(content) +
+				"```\n" +
+				"Yay!\n",
+		},
 		{
 			name: "ignore commands in code blocks",
 			in: "# This is some markdown\n" +
@@ -285,8 +316,14 @@ type mixedContentProvider struct {
 
 func (c mixedContentProvider) Fetch(dir, path string) ([]byte, error) {
 	if !strings.HasPrefix(path, "http://") && !strings.HasPrefix(path, "https://") {
-		path = filepath.Join(dir, filepath.FromSlash(path))
-		if f, ok := c.files[path]; ok {
+		resolved := filepath.Join(dir, filepath.FromSlash(path))
+		if dir != "" {
+			base := filepath.Clean(dir) + string(os.PathSeparator)
+			if !strings.HasPrefix(filepath.Clean(resolved)+string(os.PathSeparator), base) {
+				return nil, fmt.Errorf("path %q escapes base directory", path)
+			}
+		}
+		if f, ok := c.files[resolved]; ok {
 			return f, nil
 		}
 		return nil, os.ErrNotExist