GHSA-8v2v-wjwg-vx6r

### Summary

When passing a non-existing folder to the `actix_files::Files::new()` method causes the actix server to expose unexpected files.

### Details

The `actix-files` library exposes a [`Files` struct](https://github.com/actix/actix-web/blob/fba766b4beb92278665d58815c94d336015225c5/actix-files/src/files.rs#L38) that configures an actix `service` to serve the files in a folder as static assets. Below you can find the [signature of the `Files::new` method](https://github.com/actix/actix-web/blob/fba766b4beb92278665d58815c94d336015225c5/actix-files/src/files.rs#L98):

```rust pub fn new<T: Into<PathBuf>>(mount_path: &str, serve_from: T) -> Files ```

When the `mount_path` you pass to `Files` doesn't exist, [it defaults to an empty path](https://github.com/actix/actix-web/blob/fba766b4beb92278665d58815c94d336015225c5/actix-files/src/files.rs#L104) (`Path::new()`). When the service receives a HTTP request, it [joins the request information with the empty path](https://github.com/actix/actix-web/blob/fba766b4beb92278665d58815c94d336015225c5/actix-files/src/service.rs#L136) and calls `canonicalize`. Rust resolves this path as relative and returns any file that matches it.

This behavior causes the library to expose unexpected files when the folder is not present.

### PoC

_There is a working PoC on https://github.com/Angelmmiguel/actix-files-vuln, although the next steps can be followed to reproduce the issue_

1. Clone the https://github.com/actix/examples repository. 2. Change your directory to the `basics/static-files` folder. 3. Edit the `src/main.rs` file and change the line 13 to mount a non-existing folder:

```diff - .service(Files::new("/images", "static/images/").show_files_listing()) + .service(Files::new("/images", "static/missing/").show_files_listing()) ``` 4. Run the project with `cargo run`. 5. Access the <http://localhost:8080/images/Cargo.toml> URL.

### Impact

This is an exposure of information vulnerability. It affects anyone using the `actix-files::Files` library that mounts a non-existing folder for any reason.