Security defect in preview-docs package which allows for directory traversal and download of server files

[edkelly-ovo]

Describe the bug
The file packages/cli/src/commands/preview-docs/preview-server/preview-server.ts contains a security defect that allows directory traversal of the complete file path on a server and the download of files via query parameters on the request URI.

To Reproduce
http://localhost:8080/jsp/help-sb-download.jsp?sbFileName=../../../../.redocly.yaml
http://localhost:8080/jsp/help-sb-download.jsp?sbFileName=../../{expand as needed}/etc/passwd

Expected behavior
Query parameters should be trimmed from the request URL

Logs
N/A

OpenAPI definition
N/A

openapi-cli Version(s)
1.0.0-beta.55

Node.js Version(s)
15.5.0

Additional context
PR with fix raised at #347

[adamaltman]

Was accidentally not marked as closed by #347

[dwisiswant0]

Hi, @adamaltman. I think you should publish an advisory for this.

[RomanHotsiy]

Published it: GHSA-q324-q795-2q5p