Merge pull request #4 from Pro-Fa/fix/ai-findings

Potential fix for code scanning alert no. 4: Uncontrolled data used in path expression

Author: Sander-Toonen

samples/language-service-sample/serve-sample.cjs

@@ -40,9 +40,13 @@ const server = http.createServer((req, res) => {
         urlPath = 'samples/language-service-sample' + urlPath;
     }
 
-    const filePath = path.join(root, urlPath);
+    const relativePath = urlPath.replace(/^\/+/, '');
+    const filePath = path.resolve(root, relativePath);
+    const relativeToRoot = path.relative(root, filePath);
+    if (relativeToRoot.startsWith('..') || path.isAbsolute(relativeToRoot)) {
+        return send(res, 403, 'Forbidden');
+    }
 
-    // OBVIOUSLY THIS IS NOT SECURE! DO NOT USE IN UNSAFE ENVIRONMENTS!
     fs.stat(filePath, (err, stat) => {
         if (err) {
             return send(res, 404, 'Not found');