safeSegments

Decodes a request path into safe segments. Everything that could leave the directory is rejected, whatever the encoding: .. and . segments after decoding (so %2e%2e, ..%2f), NUL and other control characters, backslashes, and malformed escapes. Double-encoded input is decoded once only, so %252e%252e stays a harmless literal name.

Import#

import { safeSegments } from "@shadow-js/dusk/node";

Signature#

function safeSegments(pathname: string): string[] | undefined

Parameters#

Returns#

The segments, or undefined when the path must be refused.

Examples#

safeSegments("/a/%2e%2e/b"); // undefined
safeSegments("/css/app.css"); // ["css", "app.css"]