Add path traversal protection to MaintenanceFilter custom view includes

[Copilot]

Fixes path traversal vulnerability where $_CustomView parameter is included without validation, allowing potential access to arbitrary files via patterns like ../../../etc/passwd.

Changes

Path validation in renderMaintenancePage():

• Real filesystem: validates resolved path via realpath() is within resources/ directory
• Virtual filesystem (tests): validates path components don't contain .. traversal patterns
• Throws RuntimeException on invalid paths

Added containsDirectoryTraversal() helper:

• Normalizes path separators (handles Windows/Unix)
• Splits path and checks for .. as directory component
• Allows legitimate filenames containing .. (e.g., ..test.php)

// Validate path to prevent directory traversal attacks
$realPath = realpath( $customViewPath );

if( $realPath === false ) {
    // Virtual filesystem: check for traversal patterns
    if( $this->containsDirectoryTraversal( $customViewPath ) ) {
        throw new \RuntimeException( 'Invalid custom view path: directory traversal detected' );
    }
} else {
    // Real filesystem: ensure path is within resources directory
    $basePath = realpath( __DIR__ . '/../../../resources' );
    if( $basePath !== false && strpos( $realPath, $basePath ) !== 0 ) {
        throw new \RuntimeException( 'Invalid custom view path: path must be within the resources directory' );
    }
}

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}