Skip to content

Commit 5d30bdb

Browse files
committed
fix file verification
1 parent 831cfae commit 5d30bdb

1 file changed

Lines changed: 19 additions & 4 deletions

File tree

src/api/routes.ts

Lines changed: 19 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -46,10 +46,25 @@ const defaultConfig: THeadlessConfig = {
4646

4747
apiRoutes.post('/process', async (req, res) => {
4848
try {
49-
// Sanitize and validate input
50-
const sanitizedPath = req.body.import?.filepath?.replace(/[<>:"|?*]/g, '_');
51-
if (sanitizedPath && !path.isAbsolute(sanitizedPath)) {
52-
throw new Error('Filepath must be absolute');
49+
const filepath = req.body.import?.filepath;
50+
51+
let sanitizedPath;
52+
if (filepath && /^[a-zA-Z]:/.test(filepath)) {
53+
const driveLetter = filepath.slice(0, 2);
54+
const pathPart = filepath.slice(2);
55+
sanitizedPath = driveLetter + pathPart.replace(/[<>"|?*]/g, '_');
56+
} else {
57+
sanitizedPath = filepath?.replace(/[<>:"|?*]/g, '_');
58+
}
59+
60+
61+
if (sanitizedPath) {
62+
const isWinAbsolute = /^[a-zA-Z]:[\\\/]/.test(sanitizedPath);
63+
const isUnixAbsolute = path.isAbsolute(sanitizedPath);
64+
65+
if (!isWinAbsolute && !isUnixAbsolute) {
66+
throw new Error('Filepath must be absolute');
67+
}
5368
}
5469

5570
// Deep merge provided config with defaults

0 commit comments

Comments
 (0)