(path: string, root: string)
| 18 | } |
| 19 | |
| 20 | export function isPathInsideRoot(path: string, root: string): boolean { |
| 21 | const resolvedPath = resolve(expandHomePath(path)); |
| 22 | const resolvedRoot = resolve(expandHomePath(root)); |
| 23 | const relationship = relative(resolvedRoot, resolvedPath); |
| 24 | |
| 25 | return ( |
| 26 | relationship === "" || |
| 27 | (!isAbsolute(relationship) && |
| 28 | !relationship.startsWith("..") && |
| 29 | relationship !== ".." && |
| 30 | !relationship.includes(`..${sep}`)) |
| 31 | ); |
| 32 | } |
| 33 | |
| 34 | export function assertAllowedPath(path: string, allowedRoots: string[]): string { |
| 35 | const resolvedPath = resolve(expandHomePath(path)); |
no test coverage detected