path-sanitizer 4.0.1 → 4.0.3

package/.github/workflows/ci.yml

@@ -11,6 +11,8 @@ on:
 jobs:
   test:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
       - name: Checkout

package/dist/index.d.ts

@@ -1,8 +1,8 @@
 export interface SanitizeOptions {
-    decode?: ({
+    decode?: {
         regex: RegExp;
         replacement: string;
-    })[];
+    }[];
     /**
      * RegEx that filters out stuff like \..\ or /../
      */
@@ -13,10 +13,10 @@ export interface SanitizeOptions {
     notAllowedRegEx?: RegExp;
 }
 interface SanitizeOptionsComplete {
-    decode: ({
+    decode: {
         regex: RegExp;
         replacement: string;
-    })[];
+    }[];
     /**
      * RegEx that filters out stuff like \..\ or /../
      */

package/dist/index.js

@@ -1,21 +1,21 @@
-import { normalize, join } from "node:path";
+import { normalize, join } from 'node:path';
 export const DEFAULT_OPTIONS = {
     decode: [
         {
             regex: /%2e/g,
-            replacement: '.'
+            replacement: '.',
         },
         {
             regex: /%2f/g,
-            replacement: '/'
+            replacement: '/',
         },
         {
             regex: /%5c/g,
-            replacement: '\\'
-        }
+            replacement: '\\',
+        },
     ],
     parentDirectoryRegEx: /[\/\\]\.\.[\/\\]/g,
-    notAllowedRegEx: /:|\$|!|'|"|@|\+|`|\||=/g
+    notAllowedRegEx: /:|\$|!|'|"|@|\+|`|\||=/g,
 };
 /**
  * Sanitizes a portion of a path to avoid Path Traversal
@@ -38,7 +38,7 @@ export default function sanitize(pathstr, options = DEFAULT_OPTIONS) {
     let sanitizedPath = pathstr;
     // ################################################################################################################
     // Decode
-    options.decode.forEach(decode => {
+    options.decode.forEach((decode) => {
         sanitizedPath = sanitizedPath.replace(decode.regex, decode.replacement);
     });
     // Remove not allowed characters
@@ -73,7 +73,12 @@ export default function sanitize(pathstr, options = DEFAULT_OPTIONS) {
     // Replace /../ with /
     sanitizedPath = sanitizedPath.replace(options.parentDirectoryRegEx, '/');
     // Remove ./ or / at start
-    while (sanitizedPath.startsWith('/') || sanitizedPath.startsWith('./') || sanitizedPath.endsWith('/..') || sanitizedPath.endsWith('/../') || sanitizedPath.startsWith('../') || sanitizedPath.startsWith('/../')) {
+    while (sanitizedPath.startsWith('/') ||
+        sanitizedPath.startsWith('./') ||
+        sanitizedPath.endsWith('/..') ||
+        sanitizedPath.endsWith('/../') ||
+        sanitizedPath.startsWith('../') ||
+        sanitizedPath.startsWith('/../')) {
         sanitizedPath = sanitizedPath.replace(/^\.\//g, ''); // ^./
         sanitizedPath = sanitizedPath.replace(/^\//g, ''); // ^/
         // Remove ../ | /../ at pos 0 and /.. | /../ at end
@@ -82,7 +87,7 @@ export default function sanitize(pathstr, options = DEFAULT_OPTIONS) {
         sanitizedPath = sanitizedPath.replace(/[\/\\]\.\.$/g, '/');
         sanitizedPath = sanitizedPath.replace(/[\/\\]\.\.\/$/g, '/');
     }
-    // Make sure out is not "."
-    sanitizedPath = sanitizedPath.trim() === '.' ? '' : sanitizedPath;
+    // Make sure out is not "." or ".." or any amount of "only dots"
+    sanitizedPath = sanitizedPath.trim().replace(/^(\.*)$/g, '');
     return sanitizedPath.trim();
 }

package/package.json

@@ -1,34 +1,34 @@
 {
-    "name": "path-sanitizer",
-    "version": "4.0.1",
-    "description": "A simple lightweight npm package for sanitizing paths to prevent Path Traversal",
-    "type": "module",
-    "main": "dist/index.js",
-    "types": "dist/index.d.ts",
-    "exports": {
-        ".": {
-            "import": "./dist/index.js",
-            "types": "./dist/index.d.ts"
-        }
-    },
-    "scripts": {
-        "test": "vitest",
-        "build": "tsc"
-    },
-    "keywords": [],
-    "author": "Cabra (https://github.com/cabraviva)",
-    "license": "MIT",
-    "repository": {
-        "type": "git",
-        "url": "git+https://github.com/cabraviva/path-sanitizer.git"
-    },
-    "bugs": {
-        "url": "https://github.com/cabraviva/path-sanitizer/issues"
-    },
-    "homepage": "https://github.com/cabraviva/path-sanitizer#readme",
-    "devDependencies": {
-        "@types/node": "^22.10.2",
-        "typescript": "^5.7.2",
-        "vitest": "^2.1.8"
+  "name": "path-sanitizer",
+  "version": "4.0.3",
+  "description": "A simple lightweight npm package for sanitizing paths to prevent Path Traversal",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
     }
+  },
+  "scripts": {
+    "test": "vitest",
+    "build": "tsc"
+  },
+  "keywords": [],
+  "author": "Cabra (https://github.com/cabraviva)",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/cabraviva/path-sanitizer.git"
+  },
+  "bugs": {
+    "url": "https://github.com/cabraviva/path-sanitizer/issues"
+  },
+  "homepage": "https://github.com/cabraviva/path-sanitizer#readme",
+  "devDependencies": {
+    "@types/node": "^25.3.2",
+    "typescript": "^5.9.3",
+    "vitest": "^4.0.18"
+  }
 }

package/pnpm-workspace.yaml

@@ -1,2 +1,2 @@
-onlyBuiltDependencies:
-  - esbuild
+allowBuilds:
+  esbuild: true

package/tsconfig.json

@@ -1,16 +1,13 @@
 {
-    "compilerOptions": {
-        "target": "ESNEXT",
-        "module": "ESNext",
-        "moduleResolution": "node",
-        "declaration": true,
-        "outDir": "./dist",
-        "strict": true
-    },
-    "include": [
-        "lib/*.ts"
-    ],
-    "exclude": [
-        "lib/*.test.ts"
-    ]
-}
+  "compilerOptions": {
+    "target": "ESNEXT",
+    "module": "nodenext",
+    "moduleResolution": "nodenext",
+    "declaration": true,
+    "rootDir": "./lib",
+    "outDir": "./dist",
+    "strict": true
+  },
+  "include": ["lib/*.ts"],
+  "exclude": ["lib/*.test.ts"]
+}