Fix staticmw

[aldas]

Fix directory traversal vulnerability under Windows in Static middleware when default Echo filesystem is used. Reported by @shblue21.

This applies to cases when:

• Windows is used as OS
• middleware.StaticConfig.Filesystem is nil (default)
• echo.Filesystem is has not been set explicitly (default)

[codecov]

Codecov Report

❌ Patch coverage is 76.47059% with 8 lines in your changes missing coverage. Please review.
✅ Project coverage is 92.92%. Comparing base (0954d6e) to head (48f25a6).
⚠️ Report is 8 commits behind head on master.

Files with missing lines	Patch %	Lines
middleware/static.go	72.00%	3 Missing and 4 partials ⚠️
middleware/static_other.go	85.71%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #2891      +/-   ##
==========================================
- Coverage   93.02%   92.92%   -0.10%     
==========================================
  Files          43       43              
  Lines        4456     4480      +24     
==========================================
+ Hits         4145     4163      +18     
- Misses        194      197       +3     
- Partials      117      120       +3     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[aldas]

This is a major f*ckup.

We have tests for this same thing for 5+ years (from latest vuln) but in tests we created new filesystem and did not use default one. Default one can not access _fixtures folder when tests are run in middlewares folder and to get tests run we created one os.DirFS("../").

This was introduced in first v5 proposal branch in ~2021.10

[shblue21]

Thanks for maintaining Echo I use it a lot and really appreciate the work.
In my experience it’s one of the fastest-performing Go web frameworks.

Thanks for looking into this quickly and the transparency here.
Windows + default filesystem behavior is a tricky edge case, and I appreciate you addressing it promptly.
I’m glad this is fixed in v5.0.3, and I appreciate you coordinating the advisory/CVE process.