fix: prevent path traversal in sourceMapViewer /file endpoint

Closes https://github.com/dart-lang/sdk/pull/63389

GitOrigin-RevId: 882cfd8dcdbd2d615bd0f7da40d3d83105924fbc
Change-Id: If510820433729765a09c9784f0364bbb52e703c8
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/504020
Reviewed-by: Nate Biggs <natebiggs@google.com>
Commit-Queue: Nate Biggs <natebiggs@google.com>

tools/dart2js/sourceMapViewer/bin/source_map_viewer.dart

@@ -46,6 +46,15 @@ void handleFile(HttpRequest request) {
     return;
   }
 
+  // Prevent path traversal and absolute path injection.
+  // Source references in source maps are relative to the map file; there is
+  // no legitimate reason for a /file request to escape the map's directory.
+  if (path.contains('..') || path.startsWith('/') || path.startsWith('file:')) {
+    request.response.statusCode = HttpStatus.FORBIDDEN;
+    request.response.close();
+    return;
+  }
+
   Uri uri = sourceMapFile.resolve(path);
   new File.fromUri(uri)
       .openRead()