Potential fix for code scanning alert no. 8: Uncontrolled data used in path expression

[johnsamuelwrites]

Potential fix for https://github.com/johnsamuelwrites/ShExStatements/security/code-scanning/8

In general, to fix uncontrolled path usage you must (1) normalize the user‑provided path, and (2) enforce that the resulting path is within a designated safe directory or an explicit allow‑list, rejecting anything else. Simply disallowing absolute paths and .. segments is not sufficient if the application can have a sensitive working directory.

In this code, the minimal, backward‑compatible fix is to introduce a single “safe root” directory (e.g. the process’ current working directory) for all file accesses in generate_shex_from_csv when filename is True. We then:

1. Strip and normalize the provided filepath to remove redundant separators and .. segments.
2. Reject empty paths.
3. Build a full path with os.path.join(base_dir, normalized_path).
4. Normalize that full path again and verify that it still resides under base_dir using a robust prefix check (os.path.commonpath), which correctly handles cases where simple string startswith would fail.
5. Use this safe_fullpath when opening the file.

This keeps existing functionality (relative paths still work) but prevents traversal outside the chosen base directory and blocks absolute paths implicitly (since os.path.join(base_dir, abs_path) discards base_dir, which will then fail the commonpath check). We only need to modify shexstatements/shexfromcsv.py inside the if filename: branch; no changes are required in application.py. We will add the new logic in place of the current ad‑hoc normalized_path checks, reusing the existing import os.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.