@intlayer/config
Version:
Retrieve Intlayer configurations and manage environment variables for both server-side and client-side environments.
18 lines (16 loc) • 743 B
JavaScript
import { resolve, sep } from "node:path";
//#region src/utils/pathSecurity.ts
/**
* Throws if `resolvedPath` escapes `baseDir`.
* Use this before any file operation whose path is derived from user-controlled
* input (e.g. dictionary keys, filePath fields from dictionary data) to prevent
* path-traversal attacks.
*/
const assertPathWithin = (resolvedPath, baseDir) => {
const normalizedBase = resolve(baseDir);
const normalizedPath = resolve(resolvedPath);
if (normalizedPath !== normalizedBase && !normalizedPath.startsWith(normalizedBase + sep)) throw new Error(`Path traversal detected: "${resolvedPath}" escapes the base directory "${baseDir}"`);
};
//#endregion
export { assertPathWithin };
//# sourceMappingURL=pathSecurity.mjs.map