mikedeboer / jsDAV

jsDAV allows you to easily add WebDAV support to a NodeJS application. jsDAV is meant to cover the entire standard, and attempts to allow integration using an easy to understand API.
http://www.mikedeboer.nl
MIT License
681 stars 159 forks source link

Tree insideSandbox doesn't account for immediate parent directory #149

Open mnutt opened 8 years ago

mnutt commented 8 years ago

At least on node v4/v6, Path.relative returns .. when a directory is compared with its immediate parent. This will cause insideSandbox to return true even though the parent isn't inside the sandbox, since it's looking for ../. I think this can be fixed by just comparing against .. instead; I can't think of any situations where that would cause issues.