()
| 185 | * @returns {string[]} Array of allowed base directory paths |
| 186 | */ |
| 187 | const getAllowedVectorStoreBaseDirs = (): string[] => { |
| 188 | const allowedDirs: string[] = [] |
| 189 | |
| 190 | // Allow user home .flowise directory |
| 191 | const userHome = getUserHome() |
| 192 | allowedDirs.push(path.join(userHome, '.flowise')) |
| 193 | |
| 194 | // Allow configured blob storage path if set |
| 195 | if (process.env.BLOB_STORAGE_PATH) { |
| 196 | allowedDirs.push(path.resolve(process.env.BLOB_STORAGE_PATH)) |
| 197 | } |
| 198 | |
| 199 | return allowedDirs |
| 200 | } |
| 201 | |
| 202 | /** |
| 203 | * Validates and sanitizes a vector store base path to prevent path traversal attacks |
no test coverage detected