fix: Synk warning changes (#4102)

* fix: risk of path transversal here.

check: https://app.snyk.io/org/thomaspoignant/project/78100f3e-bb23-411a-88aa-e30c38c00d6c\#issue-96842b81-7cbd-43c0-b8d7-e0f91f66a7e6
Signed-off-by: Thomas Poignant <thomas.poignant@gofeatureflag.org>

* fix: synk warning changes

Signed-off-by: Thomas Poignant <thomas.poignant@gofeatureflag.org>

---------

Signed-off-by: Thomas Poignant <thomas.poignant@gofeatureflag.org>

Author: thomaspoignant

exporter/azureexporter/exporter.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"log/slog"
 	"os"
+	"path"
 
 	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
 	"github.com/Azure/azure-sdk-for-go/sdk/storage/azblob"
@@ -94,7 +95,7 @@ func (f *Exporter) Export(
 
 	for _, file := range files {
 		fileName := file.Name()
-		of, err := os.Open(outputDir + "/" + fileName)
+		of, err := os.Open(outputDir + "/" + path.Clean(fileName))
 		if err != nil {
 			logger.Error(
 				"[Azure Exporter] impossible to open file",

exporter/fileexporter/exporter_test.go

@@ -3,6 +3,7 @@ package fileexporter_test
 import (
 	"context"
 	"os"
+	"path"
 	"path/filepath"
 	"runtime"
 	"strings"
@@ -542,7 +543,7 @@ func TestExportWithoutOutputDir(t *testing.T) {
 	for _, file := range files {
 		if strings.HasPrefix(file.Name(), filePrefix) {
 			countFileWithPrefix++
-			err := os.Remove(file.Name())
+			err := os.Remove(path.Clean(file.Name()))
 			require.NoError(t, err)
 		}
 	}

exporter/gcstorageexporter/exporter.go

@@ -6,6 +6,7 @@ import (
 	"io"
 	"log/slog"
 	"os"
+	"path"
 
 	"cloud.google.com/go/storage"
 	"github.com/thomaspoignant/go-feature-flag/exporter"
@@ -97,7 +98,7 @@ func (f *Exporter) Export(
 	}
 
 	for _, file := range files {
-		of, err := os.Open(outputDir + "/" + file.Name())
+		of, err := os.Open(outputDir + "/" + path.Clean(file.Name()))
 		if err != nil {
 			logger.Error("[GCP Exporter] impossible to open the file",
 				slog.String("path", outputDir+"/"+file.Name()))
@@ -108,7 +109,7 @@ func (f *Exporter) Export(
 		// prepend the path
 		source := file.Name()
 		if f.Path != "" {
-			source = f.Path + "/" + file.Name()
+			source = f.Path + "/" + path.Clean(file.Name())
 		}
 
 		wc := client.Bucket(f.Bucket).Object(source).NewWriter(ctx)