isParentDirectory() — astro Function Reference

Source Code

packages/internal-helpers/src/path.ts lines 189–223

export function isParentDirectory(parentPath: string, childPath: string): boolean {
	if (!parentPath || !childPath) {
		return false;
	}

	// Reject any URLs
	if (parentPath.includes('://') || childPath.includes('://')) {
		return false;
	}

	// Reject remote or suspicious paths
	if (isRemotePath(parentPath) || isRemotePath(childPath)) {
		return false;
	}

	// Don't allow any .. in paths - too risky for traversal attacks
	if (parentPath.includes('..') || childPath.includes('..')) {
		return false;
	}

	// Reject null bytes - security risk
	if (parentPath.includes('\0') || childPath.includes('\0')) {
		return false;
	}

	const normalizedParent = appendForwardSlash(slash(parentPath).toLowerCase());
	const normalizedChild = slash(childPath).toLowerCase();

	// Don't allow same path (parent can't be parent of itself)
	if (normalizedParent === normalizedChild || normalizedParent === normalizedChild + '/') {
		return false;
	}

	return normalizedChild.startsWith(normalizedParent);
}