Question

here’s a little web-server function that gets a url and parses it, making sure that the client is not asking for a resource that’s not under the server’s root folder

function getUrl(url, resourceMap, rootFolder) {
    var path = require('path');
    if (typeof resourceMap[url] !== 'undefined') {
        return (path.join(rootFolder,resourceMap[url]));
    } 
    var absoluteURL = path.join(rootFolder,url);
    console.log("ROOT: "+rootFolder);
    console.log("NEW: "+absoluteURL);
    var regex = new RegExp('^' + rootFolder + '.*')
    if (absoluteURL.match(regex) === null) {
        console.log("FALSE");
        return (false);
    }
    return (absoluteURL);
}

As you can see I make sure that absoluteURL starts with rootFolder by using the regex '^' + rootFolder + '.*'

This worked well on Linux, but in windows it always returns false.

BTW the output is

ROOT: C:\Users\user\workspace
NEW: C:\Users\user\workspace\images\IMG_7102.JPG

So I know that parsing of the url is ok.

Amy ideas why?
Thanks

Answer 1

On Windows, the \s in the path become escape characters in the regex.

You need to regex-escape it:

rootFolder.replace(/[-[\/{}()*+?.\\^$|]/g, "\\$&")