Security Issue (#62)

It is currently possible to overwrite the `repoDir` by sending a repository name that starts with a "/", the `path.resolve` method prioritizes the second argument see the example below.

path.resolve("/my/repo/folder","/etc"); // /etc

This behavior gives an attacker the ability to create/write/pull repositories from an arbitrary absolute path, this issue could also impact authentication in some cases as it corrupts the repository name.

Author: masasron

lib/git.js

@@ -143,7 +143,7 @@ class Git extends EventEmitter {
         this.dirMap = repoDir;
     } else {
         this.dirMap = (dir) => {
-            return (path.normalize(dir ? path.resolve(repoDir, dir) : repoDir));
+            return (path.normalize(dir ? path.join(repoDir, dir) : repoDir));
         };
     }