shellinabox 2.21+deb13u1 fixes security defect #1153131, an ineffective
directory traversal guard.

[ Reason ]
The --static-file option fails to detect path segments including '..',
enabling access to resources outside the hierarchy intended by the
user starting the service.

This bug has been present in all versions of the package in Debian
except for 2.21+really2.21-3, which fixes this bug in sid.

[ Impact ]
Unintended access to files for users of shellinabox in trixie who use
this option to expose a directory.

[ Tests ]
Manual reproducer (documented on the bug) confirms the defect and its
resolution using the packaged daemon.

The bug poster has also tested the underlying patch in various
scenarios.

[ Risks ]
Risk of regressions. The code change is very small and has additionally
been scrutinised by the bug reporter.

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable

[ Changes ]
The existing code to guard against directory traversal escape is patched
to perform its job correctly by advancing past the directory separator
before testing for the forbidden path segment.

In trixie this is a native package so the patch is applied directly
rather than via quilt as it is in sid.

[ Other info ]
The security team has reviewed the bug and the debdiff and advised to
propose this fix via a regular stable update for the forthcoming trixie
point release.