Skip to content

Commit

Permalink
Fix path tests on Posix
Browse files Browse the repository at this point in the history
  • Loading branch information
timokoessler committed Jan 17, 2025
1 parent 60eaee4 commit 14f1004
Showing 1 changed file with 3 additions and 4 deletions.
7 changes: 3 additions & 4 deletions library/vulnerabilities/path-traversal/unsafePathStart.ts
Original file line number Diff line number Diff line change
Expand Up @@ -24,8 +24,6 @@ const linuxRootFolders = [
"/var/",
];

const windowsDriveLetterRegex = new RegExp("^[a-z]:(\\|/)", "i");

export function startsWithUnsafePath(filePath: string, userInput: string) {
// Check if path is relative (not absolute or drive letter path)
// Required because resolve will build absolute paths from relative paths
Expand All @@ -49,7 +47,7 @@ export function startsWithUnsafePath(filePath: string, userInput: string) {
return startsWithUnsafePathWindows(userInput);

Check warning on line 47 in library/vulnerabilities/path-traversal/unsafePathStart.ts

View check run for this annotation

Codecov / codecov/patch

library/vulnerabilities/path-traversal/unsafePathStart.ts#L47

Added line #L47 was not covered by tests
}

return startsWithUnsafePathPosix(normalizedPath, normalizedUserInput);
return startsWithUnsafePathPosix(normalizedPath, userInput);
}

export function startsWithUnsafePathPosix(

Check warning on line 53 in library/vulnerabilities/path-traversal/unsafePathStart.ts

View workflow job for this annotation

GitHub Actions / lint (18.x)

exported declaration 'startsWithUnsafePathPosix' not used within other modules
Expand All @@ -63,7 +61,8 @@ export function startsWithUnsafePathPosix(
// e.g. if user input is /etc/ and the path is /etc/passwd, we don't want to flag it, as long as the
// user input does not contain a subdirectory or filename
normalizedPath.startsWith(folder) &&
(userInput !== folder || userInput !== folder.slice(0, -1))
userInput !== folder &&
userInput !== folder.slice(0, -1)
)
) {
return true;
Expand Down

0 comments on commit 14f1004

Please sign in to comment.