Potential fix for code scanning alert no. 2: Uncontrolled data used in path expression

[kelsoncm]

Potential fix for https://github.com/kelsoncm/python-sc4net/security/code-scanning/2

Use a fixed allowlist mapping from trusted directory contents to absolute paths, and only open paths obtained from that map. This keeps untrusted input as a lookup key only, not as path-construction input at sink time.

Best minimal fix in tests/mocks.py (inside do_GET):

• Keep existing input validation (basename, regex, special names).
• Replace the allowed_files set + later join/realpath logic with a dictionary mapping valid filenames in dir_path to their resolved absolute paths.
• Select full_file_name from this dictionary using safe_filepath; if missing, return 404.
• Keep existence check and file read as-is (now with trusted mapped path).

This preserves current behavior while removing direct tainted-data path construction at the sink.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[codecov]

Welcome to Codecov 🎉

Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests.

Thanks for integrating Codecov - We've got you covered ☂️