# resolve-path

> Resolve a relative path against a root path with validation

Latest version **1.4.0** (published 2018-02-13) · MIT license · 0 weekly downloads

## Install

```sh
npm install resolve-path
pnpm add resolve-path
yarn add resolve-path
bun add resolve-path
```

## Health

**Score 33/100 (F)** — status: abandoned.

Positive: has types package; no vulnerabilities; high quality score.

Warnings: low downloads; no esm support.

Negative: abandoned.

## Facts

| | |
|---|---|
| Version | 1.4.0 |
| Published | 2018-02-13 |
| First published | 2014-03-23 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | separate (@types/resolve-path) |
| Module format | CommonJS |
| Node | >= 0.8 |
| Dependencies | 2 |
| Unpacked size | 9 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 34 |
| Author | Jonathan Ong |
| Maintainers | defunctzombie, dougwilson, fishrock123, jongleberry, mscdex |
| Keywords | resolve, path, safe |

## Links

- npm: https://www.npmjs.com/package/resolve-path
- Repository: https://github.com/pillarjs/resolve-path
- Homepage: https://github.com/pillarjs/resolve-path#readme
- Issues: https://github.com/pillarjs/resolve-path/issues
- npm.io page: https://npm.io/package/resolve-path

## Dependencies (2)

- [http-errors](https://npm.io/package/http-errors.md) ~1.6.2
- [path-is-absolute](https://npm.io/package/path-is-absolute.md) 1.0.1

## Alternatives

- [base64url](https://npm.io/package/base64url.md) — 6.1M weekly downloads
- [get-installed-path](https://npm.io/package/get-installed-path.md) — 502.9K weekly downloads
- [@uppy/url](https://npm.io/package/@uppy/url.md) — 185.8K weekly downloads
- [@d3fc/d3fc-shape](https://npm.io/package/@d3fc/d3fc-shape.md) — 16.2K weekly downloads
- [localizer](https://npm.io/package/localizer.md) — 226 weekly downloads

## Recent versions

- 1.4.0 (latest) — 2018-02-13
- 1.3.3 — 2016-11-15
- 1.3.2 — 2016-06-17
- 1.3.1 — 2016-02-28
- 1.3.0 — 2015-06-16
- 1.2.2 — 2015-02-17
- 1.2.1 — 2015-01-20
- 1.2.0 — 2015-01-05
- 1.1.0 — 2014-12-27
- 1.0.0 — 2014-03-23

## README

# resolve-path

[![NPM Version][npm-image]][npm-url]
[![NPM Downloads][downloads-image]][downloads-url]
[![Node.js Version][node-image]][node-url]
[![Linux Build][travis-image]][travis-url]
[![Windows Build][appveyor-image]][appveyor-url]
[![Test Coverage][coveralls-image]][coveralls-url]

Resolve a relative path against a root path with validation.

This module would protect against commons attacks like `GET /../file.js`
which reaches outside the root folder.

## Installation

This is a [Node.js](https://nodejs.org/en/) module available through the
[npm registry](https://www.npmjs.com/). Installation is done using the
[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):

```sh
$ npm install resolve-path
```

## API

```
var resolvePath = require('resolve-path')
```

### resolvePath(relativePath)

Resolve a relative path against `process.cwd()` (the process's current working
directory) and return an absolute path. *This will throw* if the resulting resolution
seems malicious. The following are malicious:

  - The relative path is an absolute path
  - The relative path contains a NULL byte
  - The relative path resolves to a path outside of `process.cwd()`
  - The relative path traverses above `process.cwd()` and back down

### resolvePath(rootPath, relativePath)

Resolve a relative path against the provided root path and return an absolute path.
*This will throw* if the resulting resolution seems malicious. The following are
malicious:

  - The relative path is an absolute path
  - The relative path contains a NULL byte
  - The relative path resolves to a path outside of the root path
  - The relative path traverses above the root and back down

## Example

### Safely resolve paths in a public directory

```js
var http = require('http')
var parseUrl = require('parseurl')
var path = require('path')
var resolvePath = require('resolve-path')

// the public directory
var publicDir = path.join(__dirname, 'public')

// the server
var server = http.createServer(function onRequest (req, res) {
  try {
    // get the pathname from the URL (decoded)
    var pathname = decodeURIComponent(parseUrl(req).pathname)

    if (!pathname) {
      res.statusCode = 400
      res.end('path required')
      return
    }

    // remove leading slash
    var filename = pathname.substr(1)

    // resolve the full path
    var fullpath = resolvePath(publicDir, filename)

    // echo the resolved path
    res.statusCode = 200
    res.end('resolved to ' + fullpath)
  } catch (err) {
    res.statusCode = err.status || 500
    res.end(err.message)
  }
})

server.listen(3000)
```

## License

[MIT](LICENSE)

[npm-image]: https://img.shields.io/npm/v/resolve-path.svg
[npm-url]: https://npmjs.org/package/resolve-path
[node-image]: https://img.shields.io/node/v/resolve-path.svg
[node-url]: http://nodejs.org/download/
[travis-image]: https://img.shields.io/travis/pillarjs/resolve-path/master.svg?label=linux
[travis-url]: https://travis-ci.org/pillarjs/resolve-path
[appveyor-image]: https://img.shields.io/appveyor/ci/dougwilson/resolve-path/master.svg?label=windows
[appveyor-url]: https://ci.appveyor.com/project/dougwilson/resolve-path
[coveralls-image]: https://img.shields.io/coveralls/pillarjs/resolve-path/master.svg
[coveralls-url]: https://coveralls.io/r/pillarjs/resolve-path?branch=master
[downloads-image]: https://img.shields.io/npm/dm/resolve-path.svg
[downloads-url]: https://npmjs.org/package/resolve-path

---
_Source: https://npm.io/package/resolve-path · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._