fix: prevent path traversal in fileReader function

[Aakarshit123]

Summary

This PR fixes a path traversal vulnerability in the fileReader function of gnoi/os/client.go.

The Vulnerability

The fileReader function previously passed the path parameter directly to os.Open() without any sanitization. A caller could pass ../../../../etc/passwd to read arbitrary files from the filesystem.

The Fix

• Added filepath.Clean to canonicalize the path
• Added validation to reject paths containing .. (directory traversal)
• Added validation to reject absolute paths (e.g., /etc/passwd)

Testing

Tested locally:

• ../../../../etc/hosts → blocked with error
• /etc/hosts → blocked (absolute path)
• testfile.txt → allowed (relative path)

Impact

This fix prevents arbitrary file read vulnerabilities without breaking existing functionality.

Related

• Reported via Google OSS VRP (Issue #538939238)
• CWE-22: Path Traversal

/cc @google/gnxi-maintainers

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[Aakarshit123]

/easycla

[Aakarshit123]

I have signed the CLA. Please re-run the check.