We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
1 parent d14f0a1 commit 0d1bfc3Copy full SHA for 0d1bfc3
1 file changed
bin/accessibility-automation/helper.js
@@ -244,10 +244,13 @@ exports.setAccessibilityEventListeners = (bsConfig) => {
244
}
245
246
// Build the correct glob pattern
247
- const cwd_path = process.cwd();
+ const resolvedPath = path.resolve(process.cwd(), supportFilesData.supportFile);
248
+ if (!resolvedPath.startsWith(process.cwd())) {
249
+ throw new Error('Path traversal attempt detected');
250
+ }
251
const globPattern = supportFilesData.supportFile.startsWith('/')
- ? cwd_path + supportFilesData.supportFile
- : path.resolve(cwd_path,supportFilesData.supportFile);
252
+ ? process.cwd() + supportFilesData.supportFile
253
+ : resolvedPath;
254
255
glob(globPattern, {}, (err, files) => {
256
if(err) {
0 commit comments