JS: recognize another prefix check for js/path-injection

[erik-krogh]

Recognize the following prefix check for js/path-injection.

app.get('/yet-another-prefix', (req, res) => {
	let path = pathModule.resolve(req.query.path);

	fs.readFileSync(path); // NOT OK

	var abs = pathModule.resolve(path); 

	if (abs.indexOf(root) !== 0) {
		fs.readFileSync(path); // NOT OK
		return;
	}
	fs.readFileSync(path); // OK - previously FP. 
});

[erik-krogh]

An evaluation was entirely uneventful.