4 ms·
Seems like your fix[1] for this is a bit fast. You are already importing `path` in that file. Also, you can do this with just one `path.relative`. Lastly, th
by wesleytodd 8y ago
Seems like your fix[1] for this is a bit fast. You are already importing `path` in that file. Also, you can do this with just one `path.relative`. Lastly, the url package method you are using is deprecated[2].
[1] https://github.com/remoteinterview/zero/commit/b4af5325c388e21a9bba4c9305c9a61693c73578 https://github.com/remoteinterview/zero/commit/b4af5325c388e...
[2] https://nodejs.org/api/url.html#url_legacy_url_api https://nodejs.org/api/url.html#url_legacy_url_api
- hombre_fatal 8y agoA simpler fix might be to canonicalize (i.e. no "..") the public folder path and the requested file path and then ensure the public path is a prefix of the other.
- Kalium 8y agoAny fix also needs to be sure to resolve any symlinks before doing a prefix check.
- the_mitsuhiko 8y agoThis fix does not even work on windows. You can still request data on a different drive.