isaacs 65037eeb32 Don't let path.normalize get above the root. ... Any path.join or path.normalize that starts with a / will not go "above" that after normalization. This is important because /../foo is almost *always* some sort of error, and doesn't match the corollary in sh: `cd $p; pwd` At the worse, this can be a vector for exploits, since a static file server might do path.join(docroot, path.normalize("/"+req)) to get the file. If the normalized request path could be something like "/../../../etc/passwd" then bad things could happen.		2010-08-01 20:20:17 -07:00
..
assert.js	Add assert.ifError	2010-05-21 12:06:12 -07:00
buffer.js	Added ability to pass offset to buffer write and toString methods as a string, i.e. '2' and encoding as anything	2010-07-25 20:16:37 -07:00
child_process.js	Specify env differently in execFile	2010-07-19 20:08:35 -07:00
crypto.js	fix whitespace errors	2010-06-29 23:59:24 -07:00
dgram.js	Datagram socket refactor. Add tests and documentation.	2010-07-15 10:27:44 -07:00
dns.js	Datagram socket refactor. Add tests and documentation.	2010-07-15 10:27:44 -07:00
events.js	More instanceof Array fixes	2010-07-15 14:37:56 -07:00
file.js	File API tweaks	2010-02-16 23:55:53 -08:00
freelist.js	Moving the http.js, net.js FreeList to being standalone.	2010-04-12 16:57:45 -07:00
fs.js	Support for reading byte ranges from files using fs.createReadStream.	2010-07-21 11:33:35 -07:00
http.js	instanceof Buffer to Buffer.isBuffer()	2010-07-15 15:58:35 -07:00
module.js	remove node::CheckBreak in favor of using the v8 debugger js object	2010-08-01 20:04:31 -07:00
net.js	Check for socket on Unix domain connect.	2010-07-26 19:02:15 -07:00
path.js	Don't let path.normalize get above the root.	2010-08-01 20:20:17 -07:00
posix.js	Rename 'posix' module to 'fs'	2010-02-12 01:04:14 -08:00
querystring.js	querystring: Removing typecasting of numeric strings to numbers	2010-07-19 11:07:08 -07:00
readline.js	Support for HOME and END in REPL.	2010-07-26 10:59:34 -07:00
repl.js	fix whitespace errors	2010-06-29 23:59:24 -07:00
string_decoder.js	fix whitespace errors	2010-06-29 23:59:24 -07:00
sys.js	Adds "pause" and "resume" events to pump and it's readable argument.	2010-07-13 17:17:20 -07:00
tcp.js	old tcp module is now tcp_old	2010-03-19 21:22:11 -07:00
url.js	Replace slow and broken for..in loops with faster for loops over the keys.	2010-04-12 10:34:35 -07:00
utils.js	utils.js links to sys.js instead of other way around	2009-10-13 19:55:28 +02:00