directory-traversal-js/dist/index.js

protect file upload & filenames with directory traversal

"use strict";
var __importStar = (this && this.__importStar) || function (mod) {
    if (mod && mod.__esModule) return mod;
    var result = {};
    if (mod != null) for (var k in mod) if (Object.hasOwnProperty.call(mod, k)) result[k] = mod[k];
    result["default"] = mod;
    return result;
}
Object.defineProperty(exports, "__esModule", { value: true });
var path = __importStar(require("path"));
function safeJoin(rootFolder, filename) {
    rootFolder = path.join(path.normalize(rootFolder), '');
    var normalizedFullPath = path.normalize(path.join(rootFolder, filename));
    var commonPathPrefix = commonPrefix([normalizedFullPath, rootFolder]);
    if (!commonPathPrefix || !commonPathPrefix.startsWith(rootFolder)) {
        throw new Error("Requested filename is outside of root directory!");
    }
    return normalizedFullPath;
}
exports.safeJoin = safeJoin;
;
function commonPrefix(paths) {
    var arr = paths.concat().sort();
    var startElement = arr[0];
    var endElement = arr[arr.length - 1];
    var L = startElement.length;
    var i = 0;
    while (i < L && startElement.charAt(i) === endElement.charAt(i))
        i++;
    return startElement.substring(0, i);
}
;