🔒 Fix path traversal vulnerability in CheckFilePath

[gonduras]

🎯 What:
The vulnerability fixed is an insufficient path sanitization flaw within WebServer.CheckFilePath. The method attempted to manually prevent directory traversal by looping over the user path and string-replacing "..", which is a known anti-pattern since OS path parsing can behave differently than naive string matching.

⚠️ Risk:
If left unfixed, this vulnerability could allow an attacker to craft a payload that bypasses the manual .. stripping, allowing unauthorized read access to internal system files outside of the intended root directory bounds. This introduces severe information disclosure risks.

🛡️ Solution:
The solution completely deprecates the manual .Contains("..") and // string replacement loops. Instead, it computes the final intended absolute path using Path.GetFullPath(). The resolved absolute user path is directly checked against the resolved absolute root path. The logic also rigorously applies a directory separator check to avoid partial-directory-name escape vulnerabilities (e.g. escaping into C:\data2 when C:\data was intended). Any deviation or resolution error firmly rejects the path.

---

PR created automatically by Jules for task 8761730276730547022 started by @gonduras

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.