fix(security): reject absolute paths in FileResourceLoader

Prevent path traversal attacks by blocking absolute paths and verifying
resolved paths stay within the configured BasePath directory.

Author: RoboNET

src/FlexRender.Core/Loaders/FileResourceLoader.cs

@@ -127,10 +127,10 @@ private static bool IsValidScheme(ReadOnlySpan<char> scheme)
     }
 
     /// <summary>
-    /// Validates the path for security issues such as path traversal attacks.
+    /// Validates the path for security issues: path traversal and absolute paths.
     /// </summary>
     /// <param name="path">The path to validate.</param>
-    /// <exception cref="ArgumentException">Thrown when path traversal is detected.</exception>
+    /// <exception cref="ArgumentException">Thrown when the path is absolute or contains traversal sequences.</exception>
     private static void ValidatePathSecurity(string path)
     {
         if (path.Contains(".."))
@@ -139,25 +139,37 @@ private static void ValidatePathSecurity(string path)
                 $"Invalid path (path traversal detected): {path}",
                 nameof(path));
         }
+
+        if (Path.IsPathRooted(path))
+        {
+            throw new ArgumentException(
+                $"Absolute paths are not allowed for security reasons: {path}. Use relative paths resolved against BasePath.",
+                nameof(path));
+        }
     }
 
     /// <summary>
-    /// Resolves a relative or absolute path to a full file system path.
+    /// Resolves a relative path against BasePath and validates the result stays within bounds.
     /// </summary>
-    /// <param name="path">The path to resolve.</param>
+    /// <param name="path">The relative path to resolve.</param>
     /// <returns>The fully resolved absolute path.</returns>
+    /// <exception cref="ArgumentException">Thrown when the resolved path escapes the base directory.</exception>
     private string ResolvePath(string path)
     {
-        if (Path.IsPathRooted(path))
-        {
-            return Path.GetFullPath(path);
-        }
+        var basePath = !string.IsNullOrEmpty(_options.BasePath)
+            ? Path.GetFullPath(_options.BasePath)
+            : Path.GetFullPath(".");
 
-        if (!string.IsNullOrEmpty(_options.BasePath))
+        var fullPath = Path.GetFullPath(Path.Combine(basePath, path));
+
+        // Ensure the resolved path is still within the base directory
+        if (!fullPath.StartsWith(basePath, StringComparison.Ordinal))
         {
-            return Path.GetFullPath(Path.Combine(_options.BasePath, path));
+            throw new ArgumentException(
+                $"Path '{path}' resolves outside the base directory.",
+                nameof(path));
         }
 
-        return Path.GetFullPath(path);
+        return fullPath;
     }
 }

tests/FlexRender.Tests/Loaders/FileResourceLoaderTests.cs

@@ -48,10 +48,10 @@ public async Task Load_WithValidFile_ReturnsStream()
         // Arrange
         var expectedContent = "Hello, World!";
         var filePath = CreateTempFile(expectedContent);
-        var loader = CreateLoader();
+        var loader = CreateLoader(Path.GetTempPath());
 
         // Act
-        var stream = await loader.Load(filePath);
+        var stream = await loader.Load(Path.GetFileName(filePath));
 
         // Assert
         stream.Should().NotBeNull();
@@ -67,8 +67,8 @@ public async Task Load_WithValidFile_ReturnsStream()
     public async Task Load_WithNonExistentFile_ThrowsFileNotFoundException()
     {
         // Arrange
-        var loader = CreateLoader();
-        var nonExistentPath = Path.Combine(Path.GetTempPath(), "nonexistent_file_12345.txt");
+        var loader = CreateLoader(Path.GetTempPath());
+        var nonExistentPath = "nonexistent_file_12345.txt";
 
         // Act
         var act = () => loader.Load(nonExistentPath);

tests/FlexRender.Tests/Loaders/ImageLoaderTests.cs

@@ -25,7 +25,7 @@ public class ImageLoaderTests : IDisposable
     /// <param name="width">Image width.</param>
     /// <param name="height">Image height.</param>
     /// <param name="color">Fill color.</param>
-    /// <returns>Path to the temporary file.</returns>
+    /// <returns>The filename (relative) of the temporary file within the temp directory.</returns>
     private string CreateTestImage(int width, int height, SKColor color)
     {
         var tempPath = Path.GetTempFileName();
@@ -41,7 +41,7 @@ private string CreateTestImage(int width, int height, SKColor color)
         _tempFiles.Add(tempPath);
         _tempFiles.Add(pngPath);
 
-        return pngPath;
+        return Path.GetFileName(pngPath);
     }
 
     /// <summary>
@@ -53,6 +53,7 @@ private string CreateTestImage(int width, int height, SKColor color)
     private static ImageLoader CreateImageLoader(FlexRenderOptions? options = null, params IResourceLoader[] loaders)
     {
         options ??= new FlexRenderOptions();
+        options.BasePath ??= Path.GetTempPath();
         return new ImageLoader(loaders, options);
     }
 
@@ -64,6 +65,7 @@ private static ImageLoader CreateImageLoader(FlexRenderOptions? options = null,
     private static ImageLoader CreateDefaultImageLoader(FlexRenderOptions? options = null)
     {
         options ??= new FlexRenderOptions();
+        options.BasePath ??= Path.GetTempPath();
         var fileLoader = new FileResourceLoader(options);
         var base64Loader = new Base64ResourceLoader(options);
         return new ImageLoader([fileLoader, base64Loader], options);