ntlogger 2.8.1 → 2.8.2

package/lib/pathReporter.js

@@ -90,11 +90,37 @@ function reportPath(callSite, callerOfCaller = null) {
         // Get base path (project root)
         const basePath = require.main?.path || process.cwd();
 
-        // Build relative path
-        const relativeDir = path
-            .relative(basePath, path.dirname(file))
-            .replace(/\\/g, '/')
-            .replace(/(\.\.\/)+/g, '');
+        // Build relative path and sanitize path traversal attempts
+        let relativeDir = path.relative(basePath, path.dirname(file));
+        
+        // Normalize the path (resolves .. and . segments safely)
+        relativeDir = path.normalize(relativeDir);
+        
+        // Ensure the normalized path doesn't escape the base directory
+        // If normalization results in a path outside basePath, use just the filename
+        const resolvedPath = path.resolve(basePath, relativeDir);
+        const resolvedBase = path.resolve(basePath);
+        if (!resolvedPath.startsWith(resolvedBase)) {
+            // Path traversal detected, use only filename
+            relativeDir = '';
+        }
+        
+        // Convert to forward slashes for consistency
+        relativeDir = relativeDir.replace(/\\/g, '/');
+        
+        // Remove any remaining path traversal sequences (defense in depth)
+        // Use multiple passes to catch all variations: ../, ..\, .., etc.
+        let previousDir = '';
+        while (relativeDir !== previousDir) {
+            previousDir = relativeDir;
+            relativeDir = relativeDir
+                .replace(/\.\.\//g, '')      // Remove ../
+                .replace(/\.\.\\/g, '')     // Remove ..\
+                .replace(/\/\.\./g, '')     // Remove /..
+                .replace(/\\\.\./g, '')     // Remove \..
+                .replace(/^\.\./g, '')      // Remove leading ..
+                .replace(/\.\.$/g, '');     // Remove trailing ..
+        }
 
         const shortPath = './' + (relativeDir ? relativeDir + '/' : '') + path.basename(file);
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ntlogger",
-  "version": "2.8.1",
+  "version": "2.8.2",
   "description": "A Custom Ready-To-Go Logging Wrapper Built on Winston",
   "keywords": [
     "custom logger",
@@ -44,5 +44,8 @@
     "@sentry/profiling-node": "^10.25.0",
     "dotenv": "^17.2.3",
     "jest": "^30.2.0"
+  },
+  "overrides": {
+    "glob": "^11.1.0"
   }
 }