path-sanitizer 4.0.0 → 4.0.2

package/.github/workflows/ci.yml

@@ -3,33 +3,31 @@ name: CI
 on:
   push:
     branches:
-      - '**'
+      - "**"
   pull_request:
     branches:
-      - '**'
+      - "**"
 
 jobs:
   test:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - uses: pnpm/action-setup@v4
-        name: Install pnpm
-        with:
-          version: 9
-          run_install: false
-
       - name: Install Node.js
         uses: actions/setup-node@v4
         with:
           node-version: 22
-          cache: 'pnpm'
 
-      - name: Install dependencies
-        run: pnpm install
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 9
+          run_install: true
 
       - name: Run tests
-        run: pnpm test
+        run: pnpm test

package/README.md

@@ -1,33 +1,36 @@
 # path-sanitizer
- A simple lightweight npm package for sanitizing paths to prevent Path Traversal
+
+A simple lightweight npm package for sanitizing paths to prevent Path Traversal
 
 # Usage
+
 ```js
 import sanitize from 'path-sanitizer'
-// or
-const sanitize = require('path-sanitizer').default
+// or in a common js environment
+const sanitize = (await import('path-sanitizer')).default
 
 console.log(sanitize('path/to/file.txt'))
 ```
 
 Or here is a more complex example:
+
 ```js
-const sanitize = require('../sanitize')
-const path = require('path')
+import sanitize from 'path-sanitizer'
+import path from 'path'
 
 // Real scenario:
-function routeHandler (myPath) {
-    // Lets just assume that the path was extracted from the request
-    // We want to read a file in the C:\Users\user\Desktop\myApp\ directory
-    // But the user should not be able to access C:\Users\user\Desktop\
-    // So we need to sanitize the path
-
-    const APP_DIR = 'C:\\Users\\user\\Desktop\\myApp\\'
-    const sanitized = path.join(APP_DIR, sanitize(myPath))
-
-    // Now we would usually read the file
-    // But in this case we will just print the path
-    console.log(sanitized)
+function routeHandler(myPath) {
+  // Lets just assume that the path was extracted from the request
+  // We want to read a file in the C:\Users\user\Desktop\myApp\ directory
+  // But the user should not be able to access C:\Users\user\Desktop\
+  // So we need to sanitize the path
+
+  const APP_DIR = 'C:\\Users\\user\\Desktop\\myApp\\'
+  const sanitized = path.join(APP_DIR, sanitize(myPath))
+
+  // Now we would usually read the file
+  // But in this case we will just print the path
+  console.log(sanitized)
 }
 
 routeHandler('my-video.mp4') // Just fine...
@@ -36,4 +39,4 @@ routeHandler('/hello.txt') // What if the path starts with a slash, and we try t
 routeHandler('////////a\\\\../hi.txt') // What if the path is not valid?
 routeHandler(500) // What if the path is not a string?
 routeHandler('/:11^^') // What if the path contains not allowed characters (like ":")?
-```
+```

package/dist/index.d.ts

@@ -1,8 +1,8 @@
 export interface SanitizeOptions {
-    decode?: ({
+    decode?: {
         regex: RegExp;
         replacement: string;
-    })[];
+    }[];
     /**
      * RegEx that filters out stuff like \..\ or /../
      */
@@ -13,10 +13,10 @@ export interface SanitizeOptions {
     notAllowedRegEx?: RegExp;
 }
 interface SanitizeOptionsComplete {
-    decode: ({
+    decode: {
         regex: RegExp;
         replacement: string;
-    })[];
+    }[];
     /**
      * RegEx that filters out stuff like \..\ or /../
      */

package/dist/index.js

@@ -1,21 +1,21 @@
-import { normalize, join } from "node:path";
+import { normalize, join } from 'node:path';
 export const DEFAULT_OPTIONS = {
     decode: [
         {
             regex: /%2e/g,
-            replacement: '.'
+            replacement: '.',
         },
         {
             regex: /%2f/g,
-            replacement: '/'
+            replacement: '/',
         },
         {
             regex: /%5c/g,
-            replacement: '\\'
-        }
+            replacement: '\\',
+        },
     ],
     parentDirectoryRegEx: /[\/\\]\.\.[\/\\]/g,
-    notAllowedRegEx: /:|\$|!|'|"|@|\+|`|\||=/g
+    notAllowedRegEx: /:|\$|!|'|"|@|\+|`|\||=/g,
 };
 /**
  * Sanitizes a portion of a path to avoid Path Traversal
@@ -38,7 +38,7 @@ export default function sanitize(pathstr, options = DEFAULT_OPTIONS) {
     let sanitizedPath = pathstr;
     // ################################################################################################################
     // Decode
-    options.decode.forEach(decode => {
+    options.decode.forEach((decode) => {
         sanitizedPath = sanitizedPath.replace(decode.regex, decode.replacement);
     });
     // Remove not allowed characters
@@ -73,7 +73,12 @@ export default function sanitize(pathstr, options = DEFAULT_OPTIONS) {
     // Replace /../ with /
     sanitizedPath = sanitizedPath.replace(options.parentDirectoryRegEx, '/');
     // Remove ./ or / at start
-    while (sanitizedPath.startsWith('/') || sanitizedPath.startsWith('./') || sanitizedPath.endsWith('/..') || sanitizedPath.endsWith('/../') || sanitizedPath.startsWith('../') || sanitizedPath.startsWith('/../')) {
+    while (sanitizedPath.startsWith('/') ||
+        sanitizedPath.startsWith('./') ||
+        sanitizedPath.endsWith('/..') ||
+        sanitizedPath.endsWith('/../') ||
+        sanitizedPath.startsWith('../') ||
+        sanitizedPath.startsWith('/../')) {
         sanitizedPath = sanitizedPath.replace(/^\.\//g, ''); // ^./
         sanitizedPath = sanitizedPath.replace(/^\//g, ''); // ^/
         // Remove ../ | /../ at pos 0 and /.. | /../ at end
@@ -82,7 +87,7 @@ export default function sanitize(pathstr, options = DEFAULT_OPTIONS) {
         sanitizedPath = sanitizedPath.replace(/[\/\\]\.\.$/g, '/');
         sanitizedPath = sanitizedPath.replace(/[\/\\]\.\.\/$/g, '/');
     }
-    // Make sure out is not "."
-    sanitizedPath = sanitizedPath.trim() === '.' ? '' : sanitizedPath;
+    // Make sure out is not "." or ".." or any amount of "only dots"
+    sanitizedPath = sanitizedPath.trim().replace(/^(\.*)$/g, '');
     return sanitizedPath.trim();
 }

package/package.json

@@ -1,34 +1,34 @@
 {
-    "name": "path-sanitizer",
-    "version": "4.0.0",
-    "description": "A simple lightweight npm package for sanitizing paths to prevent Path Traversal",
-    "type": "module",
-    "main": "dist/index.js",
-    "types": "dist/index.d.ts",
-    "exports": {
-        ".": {
-            "import": "./dist/index.js",
-            "types": "./dist/index.d.ts"
-        }
-    },
-    "scripts": {
-        "test": "vitest",
-        "build": "tsc"
-    },
-    "keywords": [],
-    "author": "Cabra (https://github.com/cabraviva)",
-    "license": "MIT",
-    "repository": {
-        "type": "git",
-        "url": "git+https://github.com/cabraviva/path-sanitizer.git"
-    },
-    "bugs": {
-        "url": "https://github.com/cabraviva/path-sanitizer/issues"
-    },
-    "homepage": "https://github.com/cabraviva/path-sanitizer#readme",
-    "devDependencies": {
-        "@types/node": "^22.10.2",
-        "typescript": "^5.7.2",
-        "vitest": "^2.1.8"
+  "name": "path-sanitizer",
+  "version": "4.0.2",
+  "description": "A simple lightweight npm package for sanitizing paths to prevent Path Traversal",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
     }
+  },
+  "scripts": {
+    "test": "vitest",
+    "build": "tsc"
+  },
+  "keywords": [],
+  "author": "Cabra (https://github.com/cabraviva)",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/cabraviva/path-sanitizer.git"
+  },
+  "bugs": {
+    "url": "https://github.com/cabraviva/path-sanitizer/issues"
+  },
+  "homepage": "https://github.com/cabraviva/path-sanitizer#readme",
+  "devDependencies": {
+    "@types/node": "^25.3.2",
+    "typescript": "^5.9.3",
+    "vitest": "^4.0.18"
+  }
 }

package/pnpm-workspace.yaml

@@ -1,2 +1,2 @@
-onlyBuiltDependencies:
-  - esbuild
+allowBuilds:
+  esbuild: true

package/tsconfig.json

@@ -1,16 +1,13 @@
 {
-    "compilerOptions": {
-        "target": "ESNEXT",
-        "module": "ESNext",
-        "moduleResolution": "node",
-        "declaration": true,
-        "outDir": "./dist",
-        "strict": true
-    },
-    "include": [
-        "lib/*.ts"
-    ],
-    "exclude": [
-        "lib/*.test.ts"
-    ]
-}
+  "compilerOptions": {
+    "target": "ESNEXT",
+    "module": "nodenext",
+    "moduleResolution": "nodenext",
+    "declaration": true,
+    "rootDir": "./lib",
+    "outDir": "./dist",
+    "strict": true
+  },
+  "include": ["lib/*.ts"],
+  "exclude": ["lib/*.test.ts"]
+}