fix: prevent local absolute paths from being treated as remote URLs (#2397)

Add filepath.IsAbs guard to IsRemote and Parse to prevent Windows drive
letter paths (e.g., C:\path) from being misinterpreted as remote URLs
by go-getter's url.Parse, which prepends file:// to drive letter paths.

Fixes #2384

Signed-off-by: Aditya Menon <amenon@canarytechnologies.com>

pkg/remote/remote.go

@@ -102,6 +102,9 @@ type Source struct {
 }
 
 func IsRemote(goGetterSrc string) bool {
+	if filepath.IsAbs(goGetterSrc) {
+		return false
+	}
 	if _, err := Parse(goGetterSrc); err != nil {
 		return false
 	}
@@ -122,6 +125,13 @@ func Parse(goGetterSrc string) (*Source, error) {
 		}
 	}
 
+	// Local absolute paths (e.g., C:\path on Windows, /path on Unix)
+	// are not remote URLs. Reject them before go-getter's url.Parse
+	// can misinterpret Windows drive letters as URL schemes.
+	if filepath.IsAbs(goGetterSrc) {
+		return nil, InvalidURLError{err: fmt.Sprintf("parse url: local absolute path is not a remote URL: %s", goGetterSrc)}
+	}
+
 	u, err := url.Parse(goGetterSrc)
 	if err != nil {
 		return nil, InvalidURLError{err: fmt.Sprintf("parse url: %v", err)}