FileSystemDirectoryResourceSource needs path containment before it's used #57

NGResourceLoader.FileSystemDirectoryResourceSource is an experimental resource source that isn't used anywhere: the framework never registers it, and no application uses it. It doesn't currently affect any running app.

If it ever is used, it needs a containment check first. resourceWithPath() resolves the requested path against the base directory without normalizing it, so a path like ../../etc/passwd would resolve outside that directory.

Fix (before the class is put to use)

Normalize the resolved path and check that it stays within the base directory:

final Path base = _basePath.toAbsolutePath().normalize();
final Path resolved = base.resolve( resourcePath ).normalize();

if( !resolved.startsWith( base ) ) {
	return Optional.empty();
}

Classpath resource sources resolve through the ClassLoader and don't have this problem.