(filePath: string, root: string)
| 64 | * one runtime before (#927/#929). |
| 65 | */ |
| 66 | export function isWithinDirectory(filePath: string, root: string): boolean { |
| 67 | let resolvedRoot: string; |
| 68 | try { |
| 69 | resolvedRoot = realpathSync(resolvePath(root)); |
| 70 | } catch { |
| 71 | return false; |
| 72 | } |
| 73 | // Resolve symlinks on the asset so an in-directory symlink pointing outside |
| 74 | // the root (e.g. evil.css -> ~/.ssh/id_rsa) is rejected, not followed. A |
| 75 | // nonexistent target keeps the lexical path; the later read simply fails. |
| 76 | let resolved = resolvePath(filePath); |
| 77 | try { |
| 78 | resolved = realpathSync(resolved); |
| 79 | } catch { |
| 80 | // asset does not exist yet — fall through with the lexical path |
| 81 | } |
| 82 | const rel = relative(resolvedRoot, resolved); |
| 83 | return rel === "" || (!!rel && !rel.startsWith("..") && !isAbsolute(rel)); |
| 84 | } |
| 85 | |
| 86 | /** |
| 87 | * Resolve the absolute file an /api/open-in request may launch and confirm it |
no outgoing calls
no test coverage detected