feat(service): ensureFolderPath

lib/components/services/localfilestorage/index.js

@@ -16,6 +16,11 @@ class LocalFilestorage {
   async ensureFolderPath (folderPath) {
     const rootedPath = path.join(this.rootPath_, folderPath)
 
+    const isRooted = path.relative(this.rootPath_, rootedPath)
+    if (isRooted.includes('.') || isRooted === '') {
+      throw new Error(`Bad folder path - ${folderPath}`)
+    }
+
     await fsp.mkdir(rootedPath, { recursive: true })
   }
 } // class LocalFilestorage

package.json

@@ -28,6 +28,7 @@
     "@semantic-release/git": "9.0.0",
     "@wmfs/tymly": "1.140.0",
     "chai": "4.2.0",
+    "chai-as-promised": "7.1.1",
     "chai-string": "1.5.0",
     "codecov": "3.7.0",
     "conventional-changelog-metahub": "4.0.1",

test/methods.js

@@ -3,6 +3,7 @@
 const chai = require('chai')
 chai.use(require('dirty-chai'))
 chai.use(require('chai-string'))
+chai.use(require('chai-as-promised'))
 const expect = chai.expect
 
 const path = require('path')
@@ -36,27 +37,44 @@ describe('exercise methods', () => {
   }) // beforeEach
 
   describe('ensureFolderPath', () => {
-    it('absolute paths are rooted in root path', async () => {
-      await localstorage.ensureFolderPath('/absolute')
+    describe('create good paths', () => {
+      it('absolute paths are rooted in root path', async () => {
+        await localstorage.ensureFolderPath('/absolute')
 
-      expect(fs.existsSync(path.join(rootPath, 'absolute'))).to.be.true()
-    })
+        expect(fs.existsSync(path.join(rootPath, 'absolute'))).to.be.true()
+      })
 
-    it('relative paths are resolved relative to root path', async () => {
-      await localstorage.ensureFolderPath('relative')
+      it('relative paths are resolved relative to root path', async () => {
+        await localstorage.ensureFolderPath('relative')
 
-      expect(fs.existsSync(path.join(rootPath, 'relative'))).to.be.true()
-    })
+        expect(fs.existsSync(path.join(rootPath, 'relative'))).to.be.true()
+      })
 
-    it('can create nested directories', async () => {
-      const folderPath = 'one/two/three/deep'
-      await localstorage.ensureFolderPath(folderPath)
+      it('can create nested directories', async () => {
+        const folderPath = 'one/two/three/deep'
+        await localstorage.ensureFolderPath(folderPath)
 
-      let checkPath = rootPath
-      for (const p of folderPath.split('/')) {
-        checkPath = path.join(checkPath, p)
-        expect(fs.existsSync(checkPath)).to.be.true()
-      }
+        let checkPath = rootPath
+        for (const p of folderPath.split('/')) {
+          checkPath = path.join(checkPath, p)
+          expect(fs.existsSync(checkPath)).to.be.true()
+        }
+      })
+    }) // good paths
+
+    describe('reject naughty paths that try to escape rootPath', () => {
+      const badPaths = [
+        '.',
+        '..',
+        '../../../poop',
+        'start/out/ok/but/../../../../../../../oh'
+      ]
+
+      for (const p of badPaths) {
+        it(p, () => {
+          return expect(localstorage.ensureFolderPath(p)).to.eventually.be.rejectedWith(Error)
+        })
+      } // for ...
     })
   })
 })