fix(resourceinfo): reject manifest paths escaping the destination

[Rakdos8]

Summary

Closes a zip-slip / path-traversal arbitrary file write in the resource
unpack path.

Problem

m_relativePath comes straight from the manifest and was joined onto
basePath and written (5 Put* sites) with no containment check. A
manifest entry such as ../../x or an absolute path wrote files anywhere
on disk.

Fix

Add a file-local IsPathWithinBase helper (weakly_canonical +
lexically_relative, with a lexical-normalise fallback) and guard every
write site, returning the existing MALFORMED_RESOURCE_INPUT result when
the target escapes basePath.

Type

Security — path traversal / arbitrary file write (Critical).

Testing

Manual review; legitimate relative paths resolve within base and are
unaffected; ../absolute escapes are now refused.

[CCP-Aporia]

Hi @Rakdos8

Thank you for the PR and apologies for the late response. We are still in the process of sorting out some details around contribution guidelines and PR templates.

It would be great if you could add a test case for this problem to the test suite.

[Rakdos8]

Hi @Rakdos8

Thank you for the PR and apologies for the late response. We are still in the process of sorting out some details around contribution guidelines and PR templates.

It would be great if you could add a test case for this problem to the test suite.

No worries about the delay, and thanks for taking a look!

I've added a test case for this: UnpackBundleRejectsZipSlipRelativePath in tests/src/ResourcesLibraryTest.cpp, along
with a small manifest fixture under tests/testData/ZipSlip/.

It exercises the real-world vector end-to-end through the public API:

1. Imports a ResourceGroup whose single resource has a RelativePath that escapes the destination (../zipSlipEscaped.txt).
2. Bundles it (reading the data from the local CDN by location, so the malicious path only takes effect at unpack
   time).
3. Unpacks the bundle and asserts that Unpack returns MALFORMED_RESOURCE_INPUT and that no file is written outside the destination base path.

Without the containment check the unpack would write zipSlipEscaped.txt outside the destination; with it, the put is refused before any data is written.

One note: I couldn't run the suite locally (the CMake presets target Windows/macOS and I'm on Linux). Happy to adjust the test placement or style to match your conventions once the contribution guidelines are finalized.