(path: Path.Path, root: string, url: string)
| 375 | } |
| 376 | |
| 377 | const resolveFilePath = (path: Path.Path, root: string, url: string): string | undefined => { |
| 378 | const urlPath = stripQueryString(url) |
| 379 | let decodedPath: string |
| 380 | try { |
| 381 | decodedPath = decodeURIComponent(urlPath) |
| 382 | } catch { |
| 383 | return undefined |
| 384 | } |
| 385 | if (decodedPath.includes("\u0000")) { |
| 386 | return undefined |
| 387 | } |
| 388 | const normalizedPath = path.normalize(decodedPath.startsWith("/") ? decodedPath.slice(1) : decodedPath) |
| 389 | if (normalizedPath === ".." || normalizedPath.startsWith(`..${path.sep}`)) { |
| 390 | return undefined |
| 391 | } |
| 392 | const resolvedPath = path.join(root, normalizedPath) |
| 393 | const rootPrefix = root.endsWith(path.sep) ? root : `${root}${path.sep}` |
| 394 | if (resolvedPath !== root && !resolvedPath.startsWith(rootPrefix)) { |
| 395 | return undefined |
| 396 | } |
| 397 | return resolvedPath |
| 398 | } |
| 399 | |
| 400 | const toRouteNotFoundError = (request: HttpServerRequest.HttpServerRequest) => |
| 401 | new HttpServerError.HttpServerError({ reason: new HttpServerError.RouteNotFound({ request }) }) |
no test coverage detected