Merge pull request #5 from Pro-Fa/alert-autofix-3

Potential fix for code scanning alert no. 3: Uncontrolled data used in path expression

Author: Sander-Toonen

samples/language-service-sample/serve-sample.cjs

@@ -40,10 +40,10 @@ const server = http.createServer((req, res) => {
         urlPath = 'samples/language-service-sample' + urlPath;
     }
 
-    const relativePath = urlPath.replace(/^\/+/, '');
-    const filePath = path.resolve(root, relativePath);
-    const relativeToRoot = path.relative(root, filePath);
-    if (relativeToRoot.startsWith('..') || path.isAbsolute(relativeToRoot)) {
+    const safeRelativePath = urlPath.replace(/^([/\\])+/, '');
+    const filePath = path.resolve(root, safeRelativePath);
+    const rootWithSep = root.endsWith(path.sep) ? root : root + path.sep;
+    if (!(filePath === root || filePath.startsWith(rootWithSep))) {
         return send(res, 403, 'Forbidden');
     }