security(file_svc): containment check on save_file to block agent-contact path traversal (#3380)

* security(file_svc): containment check on save_file to block path traversal

file_svc.save_file builds its target path as os.path.join(target_dir, filename)
and writes payload bytes there with no validation of the resulting location.
It is reached from the agent contact handlers with an attacker-controlled
filename:

  * app/contacts/contact_ftp.py:217  — FTP submit_uploaded_file
  * app/contacts/contact_dns.py:491  — DNS _submit_uploaded_file
  * app/contacts/contact_gist.py:212 — Gist contact upload
  * app/contacts/contact_slack.py:206 — Slack contact upload

A filename of e.g. '../../data/object_store' escapes the exfil tree and lets
an attacker write arbitrary bytes to any path the server has permission to
write. data_svc.restore_state pickle.loads('data/object_store') on the next
restart, which turns that write primitive into RCE on the team server. The
file is Fernet-encrypted with conf encryption_key, but with the documented
default encryption_key=ADMIN123 a remote attacker can forge a valid blob.

save_file has two legitimate call modes:
  (1) target_dir + basename — sink mode used by data_svc, app_svc, c_operation,
      base_knowledge_svc, and the four agent contact handlers above.
  (2) ''           + relative-path — path mode used by ability_api_manager,
      base_api_manager, and rest_svc, which assemble paths from sanitised IDs.

A simple "filename must be a basename" check breaks mode (2). Instead, resolve
the final path with realpath and require it to stay under its parent. This:

  * rejects '..' / absolute-path escape in BOTH call modes, with one check;
  * leaves all in-tree callers' happy paths intact (object_store, contact
    reports, operation logs, ability/source YAML writes);
  * provides defense-in-depth for any future caller, not just the four contact
    handlers known to be vulnerable today.

Includes a regression test that exercises three traversal vectors and
confirms each is rejected before any bytes are written.

Reported externally on 2026-05-18 alongside the broader audit pass.

* test(file_svc): fix path-traversal regression test guard

The post-condition assertion 'not os.path.exists(realpath(...))' used
'/etc/passwd' as one of the resolved-traversal targets. That file exists
on every Linux runner, so the guard would fail even when the production
code correctly raised ValueError before any I/O — what we saw in CI.

The security check (pytest.raises(ValueError, match='escapes parent'))
is unchanged; it's the only assertion that proves the fix works. The
post-condition guard is now scoped to canary basenames that cannot
pre-exist by accident, so it actually exercises 'rejected before write'
without depending on system-file absence.

---------

Co-authored-by: deacon-mp <mperry@mitre.org>