Skip to content

Commit 0680137

Browse files
ericfortisRafaelGSS
authored andcommitted
doc: clarify path.isAbsolute is not path traversal mitigation
PR-URL: #57073 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Jordan Harband <ljharb@gmail.com> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
1 parent b3caac8 commit 0680137

File tree

1 file changed

+7
-5
lines changed

1 file changed

+7
-5
lines changed

doc/api/path.md

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -315,17 +315,19 @@ added: v0.11.2
315315
* `path` {string}
316316
* Returns: {boolean}
317317

318-
The `path.isAbsolute()` method determines if `path` is an absolute path.
318+
The `path.isAbsolute()` method determines if the literal `path` is absolute.
319+
Therefore, it’s not safe for mitigating path traversals.
319320

320321
If the given `path` is a zero-length string, `false` will be returned.
321322

322323
For example, on POSIX:
323324

324325
```js
325-
path.isAbsolute('/foo/bar'); // true
326-
path.isAbsolute('/baz/..'); // true
327-
path.isAbsolute('qux/'); // false
328-
path.isAbsolute('.'); // false
326+
path.isAbsolute('/foo/bar'); // true
327+
path.isAbsolute('/baz/..'); // true
328+
path.isAbsolute('/baz/../..'); // true
329+
path.isAbsolute('qux/'); // false
330+
path.isAbsolute('.'); // false
329331
```
330332

331333
On Windows:

0 commit comments

Comments
 (0)