Draft - path traversal

[noklam]

Description

Draft for #3474

Common strategies https://www.stackhawk.com/blog/spring-path-traversal-guide-examples-and-prevention/:

1. Validate Prefix Path
2. Safelist

If we take 1., we should read logging automatically from conf_source because this is the most natural location logging.yml sits.

2. is not really possible, since it's up to user to decide.

Base on what I have read, it seems that injecting full path with environment variable is a bad idea. If we do 1. we need to make sure settings is read before _ProjectLogging (it's reverse now, we should check if this causes any problem).

Development notes

https://docs.snyk.io/snyk-cli/getting-started-with-the-snyk-cli
Run snyk code test to test it on local.

Developer Certificate of Origin

We need all contributions to comply with the Developer Certificate of Origin (DCO). All commits must be signed off by including a Signed-off-by line in the commit message. See our wiki for guidance.

If your PR is blocked due to unsigned commits, then you must follow the instructions under "Rebase the branch" on the GitHub Checks page for your PR. This will retroactively add the sign-off to all unsigned commits and allow the DCO check to pass.

Checklist

• Read the contributing guidelines
• Signed off each commit with a Developer Certificate of Origin (DCO)
• Opened this PR as a 'Draft Pull Request' if it is work-in-progress
• Updated the documentation to reflect the code changes
• Added a description of this change in the RELEASE.md file
• Added tests to cover my changes
• Checked if this change will affect Kedro-Viz, and if so, communicated that with the Viz team

[noklam]

Closed as not planned.