Commit 60fa3af
authored
chore: replace var with let/const in isRealPathSafe (#135)
## Summary
- Replace `var` with `let`/`const` in `isRealPathSafe()` in
`lib/utils.js` to fix 6 eslint `no-var` errors introduced by the
GHSA-4c3q-x735-j3r5 fix.
## Test plan
- [x] `npm run lint` passes with 0 errors1 parent 40d5f1f commit 60fa3af
1 file changed
Lines changed: 6 additions & 6 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -36,14 +36,14 @@ function isRealPathSafe(targetPath, parentDir, realParentDir, callback) { | |||
| 36 | 36 | return isPathWithinParent(p, parentDir) || isPathWithinParent(p, realParentDir); | |
| 37 | 37 | } | |
| 38 | 38 | ||
| 39 | - var relative = path.relative(parentDir, targetPath); | ||
| 40 | - var segments = relative.split(path.sep); | ||
| 41 | - var i = 0; | ||
| 42 | - var current = parentDir; | ||
| 39 | + const relative = path.relative(parentDir, targetPath); | ||
| 40 | + const segments = relative.split(path.sep); | ||
| 41 | + let i = 0; | ||
| 42 | + let current = parentDir; | ||
| 43 | 43 | ||
| 44 | 44 | function checkNext() { | |
| 45 | 45 | if (i >= segments.length) return callback(null, true); | |
| 46 | - var segment = segments[i++]; | ||
| 46 | + const segment = segments[i++]; | ||
| 47 | 47 | if (!segment || segment === '.') return checkNext(); | |
| 48 | 48 | ||
| 49 | 49 | current = path.join(current, segment); | |
@@ -61,7 +61,7 @@ function isRealPathSafe(targetPath, parentDir, realParentDir, callback) { | |||
| 61 | 61 | // Dangling symlink - check textual target | |
| 62 | 62 | return fs.readlink(current, function(err, linkTarget) { | |
| 63 | 63 | if (err) return callback(null, false); | |
| 64 | - var absTarget = path.resolve(path.dirname(current), linkTarget); | ||
| 64 | + const absTarget = path.resolve(path.dirname(current), linkTarget); | ||
| 65 | 65 | callback(null, isWithinParent(absTarget)); | |
| 66 | 66 | }); | |
| 67 | 67 | } | |
0 commit comments