| 1 | import path from "pathe"; |
| 2 | |
| 3 | /** |
| 4 | * Test lexical containment, including equality, using an explicit absolute base |
| 5 | * for relative paths. Does not follow symlinks or consult the working directory. |
| 6 | */ |
| 7 | export const isPathWithin = ( |
| 8 | directory: string, |
| 9 | candidate: string, |
| 10 | base: string, |
| 11 | ): boolean => { |
| 12 | const relative = path.relative( |
| 13 | path.resolve(base, directory), |
| 14 | path.resolve(base, candidate), |
| 15 | ); |
| 16 | return ( |
| 17 | relative === "" || |
| 18 | (!path.isAbsolute(relative) && |
| 19 | relative !== ".." && |
| 20 | !relative.startsWith("../")) |
| 21 | ); |
| 22 | }; |