fix: Prevent path traversal in FileSystemFileStore

Resolve CodeQL 'Uncontrolled data used in path expression' alerts
by validating that resolved file paths stay within the base directory.
Uses Path.GetFullPath() canonicalization and prefix check to block
directory traversal via ../ sequences in user-supplied file names.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: MikeAlhayek

src/Startup/CrestApps.Mvc.Web/Services/FileSystemFileStore.cs

@@ -6,13 +6,13 @@ public sealed class FileSystemFileStore
 
     public FileSystemFileStore(string basePath)
     {
-        _basePath = basePath;
-        Directory.CreateDirectory(basePath);
+        _basePath = Path.GetFullPath(basePath);
+        Directory.CreateDirectory(_basePath);
     }
 
     public async Task<string> SaveFileAsync(string fileName, Stream content)
     {
-        var filePath = Path.Combine(_basePath, fileName);
+        var filePath = GetSafePath(fileName);
         var directory = Path.GetDirectoryName(filePath);
         Directory.CreateDirectory(directory);
 
@@ -24,7 +24,7 @@ public async Task<string> SaveFileAsync(string fileName, Stream content)
 
     public Task<Stream> GetFileAsync(string fileName)
     {
-        var filePath = Path.Combine(_basePath, fileName);
+        var filePath = GetSafePath(fileName);
 
         if (!File.Exists(filePath))
         {
@@ -36,7 +36,7 @@ public Task<Stream> GetFileAsync(string fileName)
 
     public Task<bool> DeleteFileAsync(string fileName)
     {
-        var filePath = Path.Combine(_basePath, fileName);
+        var filePath = GetSafePath(fileName);
 
         if (File.Exists(filePath))
         {
@@ -46,4 +46,17 @@ public Task<bool> DeleteFileAsync(string fileName)
 
         return Task.FromResult(false);
     }
+
+    private string GetSafePath(string fileName)
+    {
+        var fullPath = Path.GetFullPath(Path.Combine(_basePath, fileName));
+
+        if (!fullPath.StartsWith(_basePath + Path.DirectorySeparatorChar, StringComparison.OrdinalIgnoreCase)
+            && !string.Equals(fullPath, _basePath, StringComparison.OrdinalIgnoreCase))
+        {
+            throw new ArgumentException("The file name contains an invalid path.");
+        }
+
+        return fullPath;
+    }
 }