Function isInside

test/browser/server.js:41–45

(child, parent)

 * Uses path.relative semantics which CodeQL recognizes as a path-containment
 * sanitizer for js/path-injection. */
function isInside(child, parent) {
  if (child === parent) return true;
  const rel = path.relative(parent, child);
  return rel.length > 0 && !rel.startsWith('..') && !path.isAbsolute(rel);
}

const server = http.createServer((req, res) => {
  /* Parse the request URL defensively. A malformed URL yields 400 before any