@rhinostone/swig-core 2.7.1 → 2.7.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -17,7 +17,12 @@ module.exports = function (basepath, encoding, allowOutsideRoot) {
|
|
|
17
17
|
var ret = {};
|
|
18
18
|
|
|
19
19
|
encoding = encoding || 'utf8';
|
|
20
|
-
|
|
20
|
+
// Resolve (not merely normalize) basepath to an absolute path. The root
|
|
21
|
+
// check in resolve() compares it against path.resolve()'d template paths,
|
|
22
|
+
// which are always absolute, so a relative basepath must be made absolute
|
|
23
|
+
// too -- otherwise every in-root path is wrongly rejected (CVE-2023-25345
|
|
24
|
+
// confinement must not break the legitimate relative-basepath mode).
|
|
25
|
+
basepath = (basepath) ? path.resolve(basepath) : null;
|
|
21
26
|
|
|
22
27
|
/**
|
|
23
28
|
* Resolves <var>to</var> to an absolute path or unique identifier. This is used for building correct, normalized, and absolute paths to a given template.
|