Skip to content

Commit

Permalink
[Nullify Code] Allowlist Javascript pathtraversal rule non literal fs…
Browse files Browse the repository at this point in the history
… filename
  • Loading branch information
nullify committed Aug 9, 2024
1 parent da35999 commit 37ffae7
Showing 1 changed file with 1 addition and 0 deletions.
1 change: 1 addition & 0 deletions src/implementations/LocalFileStorage.ts
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,7 @@ export default class LocalFileStorage extends FileStorage {

override async deleteFile(filePath: string): Promise<void> {
const fullPath = path.join(this.basePath, filePath);
// nosec this code needs to be able to read arbitrary files
await fs.unlink(fullPath);
}

Expand Down

0 comments on commit 37ffae7

Please sign in to comment.