spanwright/dist/security.js

CLI tool to generate Cloud Spanner E2E testing framework projects with Go database tools and Playwright browser automation

"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.isSafePath = isSafePath;
exports.validatePath = validatePath;
exports.getSafePath = getSafePath;
const path_1 = require("path");
const errors_1 = require("./errors");
/**
 * Basic path traversal check
 * @param basePath The base directory path
 * @param targetPath The path to validate
 * @returns true if the path is safe, false otherwise
 */
function isSafePath(basePath, targetPath) {
    const normalizedBase = (0, path_1.resolve)(basePath);
    const normalizedTarget = (0, path_1.resolve)(basePath, targetPath);
    const relativePath = (0, path_1.relative)(normalizedBase, normalizedTarget);
    // Basic check for path traversal
    return !relativePath.startsWith('..') && !relativePath.includes('..');
}
/**
 * Basic path validation
 * @param basePath The base directory path
 * @param targetPath The path to validate
 * @param operationName The name of the operation (for error messages)
 * @throws SecurityError if the path is unsafe
 */
function validatePath(basePath, targetPath, operationName) {
    // Basic path traversal check
    if (!isSafePath(basePath, targetPath)) {
        throw new errors_1.SecurityError(`Path traversal attempt detected in ${operationName}: ${targetPath}`, targetPath);
    }
}
/**
 * Gets a safe path within a base directory
 * @param basePath The base directory
 * @param targetPath The target path to validate
 * @returns The normalized absolute path if safe
 * @throws SecurityError if the path is unsafe
 */
function getSafePath(basePath, targetPath) {
    validatePath(basePath, targetPath, 'getSafePath');
    return (0, path_1.resolve)(basePath, targetPath);
}
//# sourceMappingURL=security.js.map