test/simple/test-url.js:31:(0110) Line too long (82 characters).
test/simple/test-url.js:39:(0110) Line too long (85 characters).
test/simple/test-url.js:40:(0110) Line too long (92 characters).
1. Express desired path.join behavior in tests.
2. Update fs.realpath to reflect new path.join behavior
3. Update url.resolve() to use new path.join behavior.
Any path.join or path.normalize that starts with a / will not go "above" that after normalization. This is important because /../foo is almost *always* some sort of error, and doesn't match the corollary in sh: `cd $p; pwd`
At the worse, this can be a vector for exploits, since a static file server might do path.join(docroot, path.normalize("/"+req)) to get the file. If the normalized request path could be something like "/../../../etc/passwd" then bad things could happen.
Before there was this comment:
Can't strip trailing slashes since module.js incorrectly
thinks dirname('/a/b/') should yield '/a/b' instead of '/a'.
But now, such thinking is corrected.
Previously path.dirname('/tmp') incorrectly returned '.'.
Unfortunately module.js incorrectly thinks dirname('/a/b/') should
yield '/a/b', so I can't strip trailing slashes yet. Once module.js
is fixed, then the commented-out code should be activated and a test
written for it.
Oleg Efimov
Ryan Dahl
isaacs
Micheil Smith
Aapo Laitinen
rentzsch
arlolra