@@ -539,6 +539,14 @@ function resolveExports(nmPath, request) {
539
539
}
540
540
541
541
const trailingSlashRegex = / (?: ^ | \/ ) \. ? \. $ / ;
542
+ const nixRelativeCheck = / ^ \. \. ? (?: [ / ] | $ ) / ;
543
+ const windowsRelativeCheck = / ^ \. \. ? (?: [ / \\ ] | $ ) / ;
544
+ /**
545
+ * @param {string } request a relative or absolute file path
546
+ * @param {Array<string> } paths file system directories to search as file paths
547
+ * @param {boolean } isMain if the request is the main app entry point
548
+ * @returns {string | false }
549
+ */
542
550
Module . _findPath = function ( request , paths , isMain ) {
543
551
const absoluteRequest = path . isAbsolute ( request ) ;
544
552
if ( absoluteRequest ) {
@@ -560,11 +568,20 @@ Module._findPath = function(request, paths, isMain) {
560
568
trailingSlash = RegExpPrototypeExec ( trailingSlashRegex , request ) !== null ;
561
569
}
562
570
571
+ const isRelative = RegExpPrototypeExec ( isWindows ? windowsRelativeCheck : nixRelativeCheck , request ) !== null ;
572
+ let insidePath = true ;
573
+ if ( isRelative ) {
574
+ const normalizedRequest = path . normalize ( request ) ;
575
+ if ( StringPrototypeStartsWith ( normalizedRequest , '..' ) ) {
576
+ insidePath = false ;
577
+ }
578
+ }
579
+
563
580
// For each path
564
581
for ( let i = 0 ; i < paths . length ; i ++ ) {
565
- // Don't search further if path doesn't exist
582
+ // Don't search further if path doesn't exist and request is inside the path
566
583
const curPath = paths [ i ] ;
567
- if ( curPath && _stat ( curPath ) < 1 ) continue ;
584
+ if ( insidePath && curPath && _stat ( curPath ) < 1 ) continue ;
568
585
569
586
if ( ! absoluteRequest ) {
570
587
const exportsResolved = resolveExports ( curPath , request ) ;
0 commit comments