🔒 fix: prevent arbitrary file read via symlink traversal in writer

[raitucarp]

🎯 What: The vulnerability fixed
The Writer methods AddContentFile, CoverFile, and AddImageFile allowed adding files by path. While filepath.IsLocal was used to lexically check for directory traversal attempts (e.g. ../), it failed to evaluate symbolic links. Thus, passing a valid local symbolic link that pointed outside the directory (e.g. link -> /etc/passwd) bypassed the check and resulted in arbitrary file read when calling os.ReadFile.

⚠️ Risk: The potential impact if left unfixed
An attacker could craft a malicious EPUB build request supplying local symlink paths to read sensitive files from the server's filesystem, resulting in arbitrary file read/path traversal vulnerability.

🛡️ Solution: How the fix addresses the vulnerability
The direct use of os.ReadFile has been replaced with the new Go 1.25 os.OpenRoot(".") API. By securely opening a handle to the current working directory, root.ReadFile(name) enforces path boundaries natively in the OS, guaranteeing that the target path (and any resolved symlinks) cannot escape the allowed directory tree. Added TestWriter_SymlinkTraversal to validate that symlink escaping is successfully blocked.

---

PR created automatically by Jules for task 8146776430047846235 started by @raitucarp

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.