tests: prevent possibility of path traversal through tests

This is not an actual security issue for how we use it for now, but
sonarcloud was shouting about it and I thought it was indeed something
that merited more attention. I tried to fix that hole.

Author: peaBerberian

tests/contents/server.mjs

@@ -610,8 +610,10 @@ function generateUrlListHtml(urls, baseUrl) {
 }
 
 async function prepareStaticFile(baseDir, url) {
-  const filePath = path.join(baseDir, url);
-  if (!filePath.startsWith(baseDir)) {
+  const filePath = path.resolve(baseDir, url);
+  const normalizedBase = path.resolve(baseDir);
+  const relative = path.relative(normalizedBase, filePath);
+  if (relative.startsWith("..") || path.isAbsolute(relative)) {
     return null;
   }
   const exists = await new Promise((resolve) => {