@@ -36,14 +36,14 @@ function isRealPathSafe(targetPath, parentDir, realParentDir, callback) { |
36 | 36 | return isPathWithinParent(p, parentDir) || isPathWithinParent(p, realParentDir); |
37 | 37 | } |
38 | 38 |
|
39 | | - var relative = path.relative(parentDir, targetPath); |
40 | | - var segments = relative.split(path.sep); |
41 | | - var i = 0; |
42 | | - var current = parentDir; |
| 39 | + const relative = path.relative(parentDir, targetPath); |
| 40 | + const segments = relative.split(path.sep); |
| 41 | + let i = 0; |
| 42 | + let current = parentDir; |
43 | 43 |
|
44 | 44 | function checkNext() { |
45 | 45 | if (i >= segments.length) return callback(null, true); |
46 | | - var segment = segments[i++]; |
| 46 | + const segment = segments[i++]; |
47 | 47 | if (!segment || segment === '.') return checkNext(); |
48 | 48 |
|
49 | 49 | current = path.join(current, segment); |
@@ -61,7 +61,7 @@ function isRealPathSafe(targetPath, parentDir, realParentDir, callback) { |
61 | 61 | // Dangling symlink - check textual target |
62 | 62 | return fs.readlink(current, function(err, linkTarget) { |
63 | 63 | if (err) return callback(null, false); |
64 | | - var absTarget = path.resolve(path.dirname(current), linkTarget); |
| 64 | + const absTarget = path.resolve(path.dirname(current), linkTarget); |
65 | 65 | callback(null, isWithinParent(absTarget)); |
66 | 66 | }); |
67 | 67 | } |
|