@intlayer/config
Version:
Retrieve Intlayer configurations and manage environment variables for both server-side and client-side environments.
20 lines (18 loc) • 938 B
JavaScript
Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
const require_runtime = require('../_virtual/_rolldown/runtime.cjs');
let node_path = require("node:path");
//#region src/utils/pathSecurity.ts
/**
* Throws if `resolvedPath` escapes `baseDir`.
* Use this before any file operation whose path is derived from user-controlled
* input (e.g. dictionary keys, filePath fields from dictionary data) to prevent
* path-traversal attacks.
*/
const assertPathWithin = (resolvedPath, baseDir) => {
const normalizedBase = (0, node_path.resolve)(baseDir);
const normalizedPath = (0, node_path.resolve)(resolvedPath);
if (normalizedPath !== normalizedBase && !normalizedPath.startsWith(normalizedBase + node_path.sep)) throw new Error(`Path traversal detected: "${resolvedPath}" escapes the base directory "${baseDir}"`);
};
//#endregion
exports.assertPathWithin = assertPathWithin;
//# sourceMappingURL=pathSecurity.cjs.map