fix: improve safety of asset path

kinde-oss · Jan 10, 2025 · 8acc264 · 8acc264
1 parent 2736f56
commit 8acc264
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/lib/main.ts b/lib/main.ts
@@ -18,6 +18,9 @@ export const version = packageVersion;
 type KindePlaceholder = `@${string}@`;
 
 const getAssetUrl = (assetPath: string, orgCode?: OrgCode) => {
+  if (!assetPath || assetPath.includes("..")) {
+    throw new Error("Invalid asset path");
+  }
   return `/${assetPath}?${orgCode ? `p_org_code=${orgCode}&` : ""}cache=@8973ff883c2c40e1bad198b543e12b24@`;
 };