mirror of
https://github.com/n8n-io/n8n.git
synced 2026-05-26 22:35:18 +02:00
18 lines
710 B
TypeScript
18 lines
710 B
TypeScript
import { isAbsolute, relative } from 'node:path';
|
|
|
|
/**
|
|
* True when `fullResolved` is strictly inside `rootResolved`. Both inputs must
|
|
* already be absolute — callers decide whether to use `resolve()` or
|
|
* `realpath()` depending on whether symlink containment matters.
|
|
*
|
|
* Rejects: equal paths, `..` traversal, and any absolute `relative()` result
|
|
* (POSIX `/foo`, Windows drive-qualified `D:\foo`, or UNC `\\server\share`).
|
|
*/
|
|
export function isContained(rootResolved: string, fullResolved: string): boolean {
|
|
const rel = relative(rootResolved, fullResolved);
|
|
if (rel === '') return false;
|
|
if (rel === '..' || rel.startsWith('..')) return false;
|
|
if (isAbsolute(rel)) return false;
|
|
return true;
|
|
}
|