path-sanitizer 3.0.1 → 4.0.0

package/.github/workflows/ci.yml

@@ -1,35 +1,35 @@
-name: CI
-
-on:
-  push:
-    branches:
-      - '**'
-  pull_request:
-    branches:
-      - '**'
-
-jobs:
-  test:
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - uses: pnpm/action-setup@v4
-        name: Install pnpm
-        with:
-          version: 9
-          run_install: false
-
-      - name: Install Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: 'pnpm'
-
-      - name: Install dependencies
-        run: pnpm install
-
-      - name: Run tests
+name: CI
+
+on:
+  push:
+    branches:
+      - '**'
+  pull_request:
+    branches:
+      - '**'
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+        name: Install pnpm
+        with:
+          version: 9
+          run_install: false
+
+      - name: Install Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: 'pnpm'
+
+      - name: Install dependencies
+        run: pnpm install
+
+      - name: Run tests
         run: pnpm test

package/README.md

@@ -1,39 +1,39 @@
-# path-sanitizer
- A simple lightweight npm package for sanitizing paths to prevent Path Traversal
-
-# Usage
-```js
-import sanitize from 'path-sanitizer'
-// or
-const sanitize = require('path-sanitizer').default
-
-console.log(sanitize('path/to/file.txt'))
-```
-
-Or here is a more complex example:
-```js
-const sanitize = require('../sanitize')
-const path = require('path')
-
-// Real scenario:
-function routeHandler (myPath) {
-    // Lets just assume that the path was extracted from the request
-    // We want to read a file in the C:\Users\user\Desktop\myApp\ directory
-    // But the user should not be able to access C:\Users\user\Desktop\
-    // So we need to sanitize the path
-
-    const APP_DIR = 'C:\\Users\\user\\Desktop\\myApp\\'
-    const sanitized = path.join(APP_DIR, sanitize(myPath))
-
-    // Now we would usually read the file
-    // But in this case we will just print the path
-    console.log(sanitized)
-}
-
-routeHandler('my-video.mp4') // Just fine...
-routeHandler('../../Documents/grades.docx') // But what if we try to access a file outside the app directory?
-routeHandler('/hello.txt') // What if the path starts with a slash, and we try to use an absolute path?
-routeHandler('////////a\\\\../hi.txt') // What if the path is not valid?
-routeHandler(500) // What if the path is not a string?
-routeHandler('/:11^^') // What if the path contains not allowed characters (like ":")?
+# path-sanitizer
+ A simple lightweight npm package for sanitizing paths to prevent Path Traversal
+
+# Usage
+```js
+import sanitize from 'path-sanitizer'
+// or
+const sanitize = require('path-sanitizer').default
+
+console.log(sanitize('path/to/file.txt'))
+```
+
+Or here is a more complex example:
+```js
+const sanitize = require('../sanitize')
+const path = require('path')
+
+// Real scenario:
+function routeHandler (myPath) {
+    // Lets just assume that the path was extracted from the request
+    // We want to read a file in the C:\Users\user\Desktop\myApp\ directory
+    // But the user should not be able to access C:\Users\user\Desktop\
+    // So we need to sanitize the path
+
+    const APP_DIR = 'C:\\Users\\user\\Desktop\\myApp\\'
+    const sanitized = path.join(APP_DIR, sanitize(myPath))
+
+    // Now we would usually read the file
+    // But in this case we will just print the path
+    console.log(sanitized)
+}
+
+routeHandler('my-video.mp4') // Just fine...
+routeHandler('../../Documents/grades.docx') // But what if we try to access a file outside the app directory?
+routeHandler('/hello.txt') // What if the path starts with a slash, and we try to use an absolute path?
+routeHandler('////////a\\\\../hi.txt') // What if the path is not valid?
+routeHandler(500) // What if the path is not a string?
+routeHandler('/:11^^') // What if the path contains not allowed characters (like ":")?
 ```

package/dist/index.js

@@ -1,9 +1,5 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEFAULT_OPTIONS = void 0;
-exports.default = sanitize;
-const node_path_1 = require("node:path");
-exports.DEFAULT_OPTIONS = {
+import { normalize, join } from "node:path";
+export const DEFAULT_OPTIONS = {
     decode: [
         {
             regex: /%2e/g,
@@ -24,17 +20,17 @@ exports.DEFAULT_OPTIONS = {
 /**
  * Sanitizes a portion of a path to avoid Path Traversal
  */
-function sanitize(pathstr, options = exports.DEFAULT_OPTIONS) {
+export default function sanitize(pathstr, options = DEFAULT_OPTIONS) {
     if (!options)
-        options = exports.DEFAULT_OPTIONS;
+        options = DEFAULT_OPTIONS;
     if (typeof options !== 'object')
         throw new Error('options must be an object');
     if (!Array.isArray(options.decode))
-        options.decode = exports.DEFAULT_OPTIONS.decode;
+        options.decode = DEFAULT_OPTIONS.decode;
     if (!options.parentDirectoryRegEx)
-        options.parentDirectoryRegEx = exports.DEFAULT_OPTIONS.parentDirectoryRegEx;
+        options.parentDirectoryRegEx = DEFAULT_OPTIONS.parentDirectoryRegEx;
     if (!options.notAllowedRegEx)
-        options.notAllowedRegEx = exports.DEFAULT_OPTIONS.notAllowedRegEx;
+        options.notAllowedRegEx = DEFAULT_OPTIONS.notAllowedRegEx;
     if (typeof pathstr !== 'string') {
         // Stringify the path
         pathstr = `${pathstr}`;
@@ -57,7 +53,7 @@ function sanitize(pathstr, options = exports.DEFAULT_OPTIONS) {
     // Replace double (back)slashes with a single slash
     sanitizedPath = sanitizedPath.replace(/[\/\\]+/g, '/');
     // Normalize path
-    sanitizedPath = (0, node_path_1.normalize)(sanitizedPath);
+    sanitizedPath = normalize(sanitizedPath);
     // Remove / or \ in the end
     while (sanitizedPath.endsWith('/') || sanitizedPath.endsWith('\\')) {
         sanitizedPath = sanitizedPath.slice(0, -1);
@@ -67,13 +63,25 @@ function sanitize(pathstr, options = exports.DEFAULT_OPTIONS) {
         sanitizedPath = sanitizedPath.slice(1);
     }
     // Validate path
-    sanitizedPath = (0, node_path_1.join)('', sanitizedPath);
+    sanitizedPath = join('', sanitizedPath);
     // Remove not allowed characters
     sanitizedPath = sanitizedPath.replace(options.notAllowedRegEx, '');
     // Again change all \ to /
     sanitizedPath = sanitizedPath.replace(/[\\]/g, '/');
     // Replace double (back)slashes with a single slash
     sanitizedPath = sanitizedPath.replace(/[\/\\]+/g, '/');
+    // Replace /../ with /
+    sanitizedPath = sanitizedPath.replace(options.parentDirectoryRegEx, '/');
+    // Remove ./ or / at start
+    while (sanitizedPath.startsWith('/') || sanitizedPath.startsWith('./') || sanitizedPath.endsWith('/..') || sanitizedPath.endsWith('/../') || sanitizedPath.startsWith('../') || sanitizedPath.startsWith('/../')) {
+        sanitizedPath = sanitizedPath.replace(/^\.\//g, ''); // ^./
+        sanitizedPath = sanitizedPath.replace(/^\//g, ''); // ^/
+        // Remove ../ | /../ at pos 0 and /.. | /../ at end
+        sanitizedPath = sanitizedPath.replace(/^[\/\\]\.\.[\/\\]/g, '/');
+        sanitizedPath = sanitizedPath.replace(/^\.\.[\/\\]/g, '/');
+        sanitizedPath = sanitizedPath.replace(/[\/\\]\.\.$/g, '/');
+        sanitizedPath = sanitizedPath.replace(/[\/\\]\.\.\/$/g, '/');
+    }
     // Make sure out is not "."
     sanitizedPath = sanitizedPath.trim() === '.' ? '' : sanitizedPath;
     return sanitizedPath.trim();

package/package.json

@@ -1,27 +1,34 @@
-{
-    "name": "path-sanitizer",
-    "version": "3.0.1",
-    "description": "A simple lightweight npm package for sanitizing paths to prevent Path Traversal",
-    "main": "dist/index.js",
-    "scripts": {
-        "test": "vitest",
-        "build": "tsc"
-    },
-    "keywords": [],
-    "author": "Cabra (https://github.com/cabraviva)",
-    "license": "MIT",
-    "repository": {
-        "type": "git",
-        "url": "git+https://github.com/cabraviva/path-sanitizer.git"
-    },
-    "bugs": {
-        "url": "https://github.com/cabraviva/path-sanitizer/issues"
-    },
-    "homepage": "https://github.com/cabraviva/path-sanitizer#readme",
-    "types": "dist/index.d.ts",
-    "devDependencies": {
-        "@types/node": "^22.9.3",
-        "typescript": "^5.7.2",
-        "vitest": "^2.1.5"
-    }
-}
+{
+    "name": "path-sanitizer",
+    "version": "4.0.0",
+    "description": "A simple lightweight npm package for sanitizing paths to prevent Path Traversal",
+    "type": "module",
+    "main": "dist/index.js",
+    "types": "dist/index.d.ts",
+    "exports": {
+        ".": {
+            "import": "./dist/index.js",
+            "types": "./dist/index.d.ts"
+        }
+    },
+    "scripts": {
+        "test": "vitest",
+        "build": "tsc"
+    },
+    "keywords": [],
+    "author": "Cabra (https://github.com/cabraviva)",
+    "license": "MIT",
+    "repository": {
+        "type": "git",
+        "url": "git+https://github.com/cabraviva/path-sanitizer.git"
+    },
+    "bugs": {
+        "url": "https://github.com/cabraviva/path-sanitizer/issues"
+    },
+    "homepage": "https://github.com/cabraviva/path-sanitizer#readme",
+    "devDependencies": {
+        "@types/node": "^22.10.2",
+        "typescript": "^5.7.2",
+        "vitest": "^2.1.8"
+    }
+}

package/pnpm-workspace.yaml

@@ -0,0 +1,2 @@
+onlyBuiltDependencies:
+  - esbuild

package/tsconfig.json

@@ -1,15 +1,16 @@
-{
-    "compilerOptions": {
-        "target": "ESNEXT",
-        "module": "commonjs",
-        "declaration": true,
-        "outDir": "./dist",
-        "strict": true
-    },
-    "include": [
-        "lib/*.ts"
-    ],
-    "exclude": [
-        "lib/*.test.ts"
-    ]
+{
+    "compilerOptions": {
+        "target": "ESNEXT",
+        "module": "ESNext",
+        "moduleResolution": "node",
+        "declaration": true,
+        "outDir": "./dist",
+        "strict": true
+    },
+    "include": [
+        "lib/*.ts"
+    ],
+    "exclude": [
+        "lib/*.test.ts"
+    ]
 }