/
githubmirror
/
angular
Обзор
Документация
Войти
/
githubmirror
/
angular
Код
Запросы
0
Пакеты
0
Релизы
0
Аналитика
Безопасность
main
packages/localize/tools/src/translate/output_path.ts
44 строки
2 KB
Alan Agius
fix(localize): validate locale in getOutputPathFn to prevent path traversal
30 мар 2026, 13:15
30 мар 2026, 13:15
7871093
Код
Авторство
О чём код?
/** * @license * Copyright Google LLC All Rights Reserved. * * Use of this source code is governed by an MIT-style license that can be * found in the LICENSE file at https://angular.dev/license */ import {AbsoluteFsPath, PathManipulation} from '@angular/compiler-cli/private/localize'; /** * A function that will return an absolute path to where a file is to be written, given a locale and * a relative path. */ export interface OutputPathFn { (locale: string, relativePath: string): string; } /** * Create a function that will compute the absolute path to where a translated file should be * written. * * The special `{{LOCALE}}` marker will be replaced with the locale code of the current translation. * @param outputFolder An absolute path to the folder containing this set of translations. */ export function getOutputPathFn(fs: PathManipulation, outputFolder: AbsoluteFsPath): OutputPathFn { const [pre, post] = outputFolder.split('{{LOCALE}}'); return post === undefined ? (_locale, relativePath) => fs.join(pre, relativePath) : (locale, relativePath) => { if (/[\/\\]|\.\./.test(locale)) { throw new Error(`Invalid Locale: '${locale}' is not a valid locale.`); } const outputPath = fs.join(pre + locale + post, relativePath); const resolvedOutputPath = fs.resolve(outputPath); const resolvedPre = fs.resolve(pre); if (!resolvedOutputPath.startsWith(resolvedPre)) { throw new Error(`Invalid Locale: '${locale}' would cause path traversal.`); } return outputPath; }; }