fix: add escape_html utility and sanitize static file paths

static.mbt

@@ -55,7 +55,17 @@ pub fn Mocket::static_assets(
       event.res.headers.set("Allow", "GET, HEAD")
       return HttpResponse::new(MethodNotAllowed)
     }
-    let original_id = event.req.url[path.length():].to_owned()
+    let raw_id = event.req.url[path.length():].to_owned()
+    let segments : Array[String] = []
+    for seg in raw_id.split("/") {
+      let s = seg.to_owned()
+      if s == ".." || s == "." || s == "" {
+        continue
+      } else {
+        segments.push(s)
+      }
+    }
+    let original_id = segments.join("/")
 
     // Parse Accept-Encoding
     // Headers are Map[StringView, StringView]

utils.mbt

@@ -100,6 +100,22 @@ fn parse_kv(part : BytesView, map : Map[String, String]) -> Unit {
   }
 }
 
+///|
+pub fn escape_html(s : String) -> String {
+  let buf = StringBuilder::new()
+  for c in s {
+    match c {
+      '&' => buf.write_string("&")
+      '<' => buf.write_string("&lt;")
+      '>' => buf.write_string("&gt;")
+      '"' => buf.write_string("&quot;")
+      '\'' => buf.write_string("&#x27;")
+      _ => buf.write_char(c)
+    }
+  }
+  buf.to_string()
+}
+
 ///|
 fn is_unreserved(b : Byte) -> Bool {
   (b >= b'A' && b <= b'Z') ||