| 24 | } |
| 25 | |
| 26 | function isSafeRelativePath(value: string) { |
| 27 | const segments = value.split("/") |
| 28 | return ( |
| 29 | value.length > 0 && |
| 30 | !value.includes("\\") && |
| 31 | !value.includes("\0") && |
| 32 | !value.includes("?") && |
| 33 | !value.includes("#") && |
| 34 | !URL.canParse(value) && |
| 35 | !path.posix.isAbsolute(value) && |
| 36 | !path.win32.isAbsolute(value) && |
| 37 | segments.every((segment) => { |
| 38 | try { |
| 39 | const decoded = decodeURIComponent(segment) |
| 40 | return ( |
| 41 | decoded.length > 0 && |
| 42 | decoded !== "." && |
| 43 | decoded !== ".." && |
| 44 | !decoded.includes("/") && |
| 45 | !decoded.includes("\\") && |
| 46 | !decoded.includes("\0") |
| 47 | ) |
| 48 | } catch { |
| 49 | return false |
| 50 | } |
| 51 | }) |
| 52 | ) |
| 53 | } |
| 54 | |
| 55 | class IndexSkill extends Schema.Class<IndexSkill>("SkillDiscovery.IndexSkill")({ |
| 56 | name: Schema.String, |