Fix #4 done: path traversal in Storage

[techmahedy]

Root Cause

The LocalFileSystem, PublicFileSystem, and shared FileSystem implementations were constructing filesystem paths using naive string concatenation:

$this->filePath . '/' . $path

This was done across methods such as get(), content(), delete(), destinationFile(), and isDirectoryExists(). The implementation did not reject path traversal sequences such as .. or verify that the resolved path remained within the intended filesystem root, creating a potential path traversal vulnerability.

Fix

The filesystem path handling has been updated to ensure that:

• Path traversal attempts using .. are rejected.
• Resolved paths are validated to remain within the configured filesystem root.
• Path construction is handled consistently across the affected filesystem methods.

Additional Finding

During the review, I also identified a third, previously unreviewed class: PublicFileSystem.php. It contained the same vulnerable path-handling pattern through the shared FileSystem base class, including the same get(), content(), and delete() behavior.

This was fixed as part of the same change to avoid leaving an obvious sibling implementation vulnerable.