path-sanitizer 3.1.0 → 4.0.1

package/.github/workflows/ci.yml

@@ -1,35 +1,31 @@
-name: CI
-
-on:
-  push:
-    branches:
-      - '**'
-  pull_request:
-    branches:
-      - '**'
-
-jobs:
-  test:
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - uses: pnpm/action-setup@v4
-        name: Install pnpm
-        with:
-          version: 9
-          run_install: false
-
-      - name: Install Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: 'pnpm'
-
-      - name: Install dependencies
-        run: pnpm install
-
-      - name: Run tests
-        run: pnpm test
+name: CI
+
+on:
+  push:
+    branches:
+      - "**"
+  pull_request:
+    branches:
+      - "**"
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 9
+          run_install: true
+
+      - name: Run tests
+        run: pnpm test

package/README.md

@@ -1,39 +1,42 @@
-# path-sanitizer
- A simple lightweight npm package for sanitizing paths to prevent Path Traversal
-
-# Usage
-```js
-import sanitize from 'path-sanitizer'
-// or
-const sanitize = require('path-sanitizer').default
-
-console.log(sanitize('path/to/file.txt'))
-```
-
-Or here is a more complex example:
-```js
-const sanitize = require('../sanitize')
-const path = require('path')
-
-// Real scenario:
-function routeHandler (myPath) {
-    // Lets just assume that the path was extracted from the request
-    // We want to read a file in the C:\Users\user\Desktop\myApp\ directory
-    // But the user should not be able to access C:\Users\user\Desktop\
-    // So we need to sanitize the path
-
-    const APP_DIR = 'C:\\Users\\user\\Desktop\\myApp\\'
-    const sanitized = path.join(APP_DIR, sanitize(myPath))
-
-    // Now we would usually read the file
-    // But in this case we will just print the path
-    console.log(sanitized)
-}
-
-routeHandler('my-video.mp4') // Just fine...
-routeHandler('../../Documents/grades.docx') // But what if we try to access a file outside the app directory?
-routeHandler('/hello.txt') // What if the path starts with a slash, and we try to use an absolute path?
-routeHandler('////////a\\\\../hi.txt') // What if the path is not valid?
-routeHandler(500) // What if the path is not a string?
-routeHandler('/:11^^') // What if the path contains not allowed characters (like ":")?
-```
+# path-sanitizer
+
+A simple lightweight npm package for sanitizing paths to prevent Path Traversal
+
+# Usage
+
+```js
+import sanitize from 'path-sanitizer'
+// or in a common js environment
+const sanitize = (await import('path-sanitizer')).default
+
+console.log(sanitize('path/to/file.txt'))
+```
+
+Or here is a more complex example:
+
+```js
+import sanitize from 'path-sanitizer'
+import path from 'path'
+
+// Real scenario:
+function routeHandler(myPath) {
+  // Lets just assume that the path was extracted from the request
+  // We want to read a file in the C:\Users\user\Desktop\myApp\ directory
+  // But the user should not be able to access C:\Users\user\Desktop\
+  // So we need to sanitize the path
+
+  const APP_DIR = 'C:\\Users\\user\\Desktop\\myApp\\'
+  const sanitized = path.join(APP_DIR, sanitize(myPath))
+
+  // Now we would usually read the file
+  // But in this case we will just print the path
+  console.log(sanitized)
+}
+
+routeHandler('my-video.mp4') // Just fine...
+routeHandler('../../Documents/grades.docx') // But what if we try to access a file outside the app directory?
+routeHandler('/hello.txt') // What if the path starts with a slash, and we try to use an absolute path?
+routeHandler('////////a\\\\../hi.txt') // What if the path is not valid?
+routeHandler(500) // What if the path is not a string?
+routeHandler('/:11^^') // What if the path contains not allowed characters (like ":")?
+```

package/dist/index.js

@@ -1,9 +1,5 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEFAULT_OPTIONS = void 0;
-exports.default = sanitize;
-const node_path_1 = require("node:path");
-exports.DEFAULT_OPTIONS = {
+import { normalize, join } from "node:path";
+export const DEFAULT_OPTIONS = {
     decode: [
         {
             regex: /%2e/g,
@@ -24,17 +20,17 @@ exports.DEFAULT_OPTIONS = {
 /**
  * Sanitizes a portion of a path to avoid Path Traversal
  */
-function sanitize(pathstr, options = exports.DEFAULT_OPTIONS) {
+export default function sanitize(pathstr, options = DEFAULT_OPTIONS) {
     if (!options)
-        options = exports.DEFAULT_OPTIONS;
+        options = DEFAULT_OPTIONS;
     if (typeof options !== 'object')
         throw new Error('options must be an object');
     if (!Array.isArray(options.decode))
-        options.decode = exports.DEFAULT_OPTIONS.decode;
+        options.decode = DEFAULT_OPTIONS.decode;
     if (!options.parentDirectoryRegEx)
-        options.parentDirectoryRegEx = exports.DEFAULT_OPTIONS.parentDirectoryRegEx;
+        options.parentDirectoryRegEx = DEFAULT_OPTIONS.parentDirectoryRegEx;
     if (!options.notAllowedRegEx)
-        options.notAllowedRegEx = exports.DEFAULT_OPTIONS.notAllowedRegEx;
+        options.notAllowedRegEx = DEFAULT_OPTIONS.notAllowedRegEx;
     if (typeof pathstr !== 'string') {
         // Stringify the path
         pathstr = `${pathstr}`;
@@ -57,7 +53,7 @@ function sanitize(pathstr, options = exports.DEFAULT_OPTIONS) {
     // Replace double (back)slashes with a single slash
     sanitizedPath = sanitizedPath.replace(/[\/\\]+/g, '/');
     // Normalize path
-    sanitizedPath = (0, node_path_1.normalize)(sanitizedPath);
+    sanitizedPath = normalize(sanitizedPath);
     // Remove / or \ in the end
     while (sanitizedPath.endsWith('/') || sanitizedPath.endsWith('\\')) {
         sanitizedPath = sanitizedPath.slice(0, -1);
@@ -67,7 +63,7 @@ function sanitize(pathstr, options = exports.DEFAULT_OPTIONS) {
         sanitizedPath = sanitizedPath.slice(1);
     }
     // Validate path
-    sanitizedPath = (0, node_path_1.join)('', sanitizedPath);
+    sanitizedPath = join('', sanitizedPath);
     // Remove not allowed characters
     sanitizedPath = sanitizedPath.replace(options.notAllowedRegEx, '');
     // Again change all \ to /

package/package.json

@@ -1,8 +1,16 @@
 {
     "name": "path-sanitizer",
-    "version": "3.1.0",
+    "version": "4.0.1",
     "description": "A simple lightweight npm package for sanitizing paths to prevent Path Traversal",
+    "type": "module",
     "main": "dist/index.js",
+    "types": "dist/index.d.ts",
+    "exports": {
+        ".": {
+            "import": "./dist/index.js",
+            "types": "./dist/index.d.ts"
+        }
+    },
     "scripts": {
         "test": "vitest",
         "build": "tsc"
@@ -18,7 +26,6 @@
         "url": "https://github.com/cabraviva/path-sanitizer/issues"
     },
     "homepage": "https://github.com/cabraviva/path-sanitizer#readme",
-    "types": "dist/index.d.ts",
     "devDependencies": {
         "@types/node": "^22.10.2",
         "typescript": "^5.7.2",

package/pnpm-workspace.yaml

@@ -0,0 +1,2 @@
+onlyBuiltDependencies:
+  - esbuild

package/tsconfig.json

@@ -1,15 +1,16 @@
-{
-    "compilerOptions": {
-        "target": "ESNEXT",
-        "module": "commonjs",
-        "declaration": true,
-        "outDir": "./dist",
-        "strict": true
-    },
-    "include": [
-        "lib/*.ts"
-    ],
-    "exclude": [
-        "lib/*.test.ts"
-    ]
+{
+    "compilerOptions": {
+        "target": "ESNEXT",
+        "module": "ESNext",
+        "moduleResolution": "node",
+        "declaration": true,
+        "outDir": "./dist",
+        "strict": true
+    },
+    "include": [
+        "lib/*.ts"
+    ],
+    "exclude": [
+        "lib/*.test.ts"
+    ]
 }