瀏覽代碼

add joinAndValidatePath method

NaokiHigashi28 1 年之前
父節點
當前提交
f8113705dd
共有 1 個文件被更改,包括 8 次插入0 次删除
  1. 8 0
      apps/app/src/features/growi-plugin/server/services/growi-plugin/growi-plugin.ts

+ 8 - 0
apps/app/src/features/growi-plugin/server/services/growi-plugin/growi-plugin.ts

@@ -402,6 +402,14 @@ export class GrowiPluginService implements IGrowiPluginService {
     return entries;
   }
 
+  private joinAndValidatePath(baseDir: string, ...paths: string[]):fs.PathLike {
+    const joinedPath = path.join(baseDir, ...paths);
+    if (!joinedPath.startsWith(baseDir)) {
+      throw new Error(`Invalid path: Outside of allowed directory - ${joinedPath}`);
+    }
+    return joinedPath;
+  }
+
 }