athea

Repositories Projects Packages

resolve-path (1.4.0)

Published 2026-02-24 14:04:22 +00:00 by atheaadmin

Installation

Setup this registry in your project .npmrc file:

registry=

To install the package using npm, run the following command:

npm install resolve-path@1.4.0

or add it to the package.json file:

"resolve-path": "1.4.0"

For more information on the npm registry, see the documentation.

About this package

resolve-path

Resolve a relative path against a root path with validation.

This module would protect against commons attacks like GET /../file.js which reaches outside the root folder.

Installation

This is a Node.js module available through the npm registry. Installation is done using the npm install command:

$ npm install resolve-path

API

var resolvePath = require('resolve-path')

resolvePath(relativePath)

Resolve a relative path against process.cwd() (the process's current working directory) and return an absolute path. This will throw if the resulting resolution seems malicious. The following are malicious:

• The relative path is an absolute path
• The relative path contains a NULL byte
• The relative path resolves to a path outside of process.cwd()
• The relative path traverses above process.cwd() and back down

resolvePath(rootPath, relativePath)

Resolve a relative path against the provided root path and return an absolute path. This will throw if the resulting resolution seems malicious. The following are malicious:

• The relative path is an absolute path
• The relative path contains a NULL byte
• The relative path resolves to a path outside of the root path
• The relative path traverses above the root and back down

Example

Safely resolve paths in a public directory

var http = require('http')
var parseUrl = require('parseurl')
var path = require('path')
var resolvePath = require('resolve-path')

// the public directory
var publicDir = path.join(__dirname, 'public')

// the server
var server = http.createServer(function onRequest (req, res) {
  try {
    // get the pathname from the URL (decoded)
    var pathname = decodeURIComponent(parseUrl(req).pathname)

    if (!pathname) {
      res.statusCode = 400
      res.end('path required')
      return
    }

    // remove leading slash
    var filename = pathname.substr(1)

    // resolve the full path
    var fullpath = resolvePath(publicDir, filename)

    // echo the resolved path
    res.statusCode = 200
    res.end('resolved to ' + fullpath)
  } catch (err) {
    res.statusCode = err.status || 500
    res.end(err.message)
  }
})

server.listen(3000)

License

MIT

Dependencies

Dependencies

ID	Version
http-errors	~1.6.2
path-is-absolute	1.0.1

Development Dependencies

ID	Version
eslint	3.19.0
eslint-config-standard	10.2.1
eslint-plugin-import	2.8.0
eslint-plugin-markdown	1.0.0-beta.6
eslint-plugin-node	5.2.1
eslint-plugin-promise	3.6.0
eslint-plugin-standard	3.0.1
istanbul	0.4.5
mocha	2.5.3

Keywords

resolve path safe

Details

npm

2026-02-24 14:04:22 +00:00

0

Jonathan Ong

Project Site

MIT

latest

3.6 KiB

Assets (1)

resolve-path-1.4.0.tgz 3.6 KiB

Versions (1) View all

1.4.0 2026-02-24