fix: prevent path traversal in ClaudeAPIClient._read_file()

[qinlongli2024-ai]

Summary

_read_file() in ClaudeAPIClient accepts file paths from untrusted security findings without validating that the resolved path stays within the repository root. A malicious PR could craft a finding with "file": "../../../etc/shadow" to exfiltrate arbitrary files from the CI runner — their contents are included verbatim in the prompt sent to the Claude API.

Attack scenario

1. Attacker opens a PR against a repository that uses claude-code-security-review.
2. The automated audit produces a finding referencing a crafted path (e.g., ../../../etc/shadow, ../../../home/runner/.ssh/id_rsa).
3. _read_file() follows the .. segments, reads the sensitive file, and embeds its content in the Claude API prompt.
4. Depending on the response handling, the file contents may be logged, stored in CI artifacts, or surfaced in PR comments.

Symlink-based escapes are also possible: a repo could include a symlink like data/config -> /etc/passwd, and the old code would follow it without complaint.

Fix

• Reject absolute paths — findings should never reference absolute paths.
• Resolve with os.path.realpath() — collapses .. segments and follows symlinks to their true destination.
• Validate containment — the resolved path must start with repo_root + os.sep to prevent partial-prefix bypasses (e.g., /repo-data matching /repo).
• Reject empty/whitespace paths early.

This mirrors the validated path-checking pattern already used in the sibling claude-code-action project (src/mcp/path-validation.ts).

Tests

Added 14 test cases covering:

• ✅ Happy paths (relative, root-level, latin-1 encoding fallback)
• 🛡️ ../ traversal (direct and prefixed)
• 🛡️ Absolute path injection (/etc/passwd)
• 🛡️ Symlink escape (symlink inside repo → file outside repo)
• 🔧 Edge cases (empty, whitespace, directory, nonexistent, REPO_PATH unset fallback)

All 14 tests pass.

Checklist

• Security fix with clear attack path
• Comprehensive test coverage
• No breaking changes (existing valid paths still work)
• Consistent with path validation in claude-code-action