isPathWithin

isPathWithin(root, path, options?): boolean

Defined in: packages/node/src/fs/path-within.ts:193

Whether path stays inside root, comparing the two as resolved sequences of path segments.

Both are resolved first, so .., ., a trailing separator and a relative input all behave as the filesystem would read them. Containment is then decided segment by segment, which is why /var/data-evil is not inside /var/data — a startsWith test on the joined strings says it is. The path being the root itself counts as within unless PathWithinOptions.allowRoot says otherwise.

This answers a question about strings, not about the filesystem. A symbolic link inside the root pointing out of it resolves within textually and reads outside it in practice; isPathWithinAsync is the variant that follows links.

Time and memory are linear in the length of the two paths.

Parameters

root

string

The directory the path must stay inside.

path

string

The path to check.

options?

PathWithinOptions

Resolution base, root-equality and case-folding policy.

Returns

boolean

True if the resolved path is inside the resolved root.

Example

  isPathWithin("/var/data", "/var/data/a/b"); // true
  isPathWithin("/var/data", "/var/data-evil/x"); // false
  isPathWithin("/var/data", "/var/data/a/../../etc/passwd"); // false
  isPathWithin("/var/data", "/var/data", { allowRoot: false }); // false
  ```;