client: return error on bad local path

If the path given in a file: URL does not exist or is not
a directory, return an error.

Change-Id: Ie7f5ff9f2a5fce7f52defc24c42c1c2aedfeb106
Reviewed-on: https://go-review.googlesource.com/c/vuln/+/399174
Run-TryBot: Jonathan Amsterdam <jba@google.com>
Reviewed-by: Zvonimir Pavlinovic <zpavlinovic@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
diff --git a/client/client.go b/client/client.go
index da8b7c6..c27556a 100644
--- a/client/client.go
+++ b/client/client.go
@@ -377,7 +377,15 @@
 			}
 			c.sources = append(c.sources, hs)
 		case strings.HasPrefix(uri, "file://"):
-			c.sources = append(c.sources, &localSource{dir: strings.TrimPrefix(uri, "file://")})
+			dir := strings.TrimPrefix(uri, "file://")
+			fi, err := os.Stat(dir)
+			if err != nil {
+				return nil, err
+			}
+			if !fi.IsDir() {
+				return nil, fmt.Errorf("%s is not a directory", dir)
+			}
+			c.sources = append(c.sources, &localSource{dir: dir})
 		default:
 			return nil, fmt.Errorf("source %q has unsupported scheme", uri)
 		}