I've done something similar in node to ensure URIs like those cannot walk up past a base directory: function saferesolve(base, target) { var targetPath =

I've done something similar in node to ensure URIs like those cannot walk up past a base directory: function saferesolve(base, target) { var targetPath = '.' + path.posix.normalize('/' + target) return path.posix.resolve(base, targetPath) } saferesolve("./datasource", "a/b") === "./datasource/a/b" saferesolve("./datasource", "a/b/../c") === "./datasource/a/c" saferesolve("./datasource", "../..") === "./datasource" saferesolve("./datasource", "../../a/b") === "./datasource/a/b" saferesolve("./datasource", "../../a/b/..") === "./datasource/a"