cauthy-auth 0.36.0 → 0.36.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. package/dist/index.js +6 -0
  2. package/dist/index.js.map +1 -1
  3. package/dist/index.mjs +6 -0
  4. package/dist/index.mjs.map +1 -1
  5. package/package.json +1 -1
package/dist/index.js CHANGED
@@ -1150,6 +1150,12 @@ function random(bytes = 32) {
1150
1150
  }
1151
1151
  function localPath(candidate, fallback) {
1152
1152
  if (!candidate || !candidate.startsWith("/") || candidate.startsWith("//") || candidate.includes("\\")) return fallback;
1153
+ if (/[\u0000-\u001f\u007f]/.test(candidate)) return fallback;
1154
+ try {
1155
+ if (new URL(candidate, "http://x").origin !== "http://x") return fallback;
1156
+ } catch {
1157
+ return fallback;
1158
+ }
1153
1159
  return candidate;
1154
1160
  }
1155
1161
  function json(body, status = 200, headers) {