TypeScript Lab: Safe File Path Gate

LAB / EXPLORATION

TypeScript Lab: Safe File Path Gate

Planned

LAB 111 — Validation & Safety
Allow project files only when resolved paths remain inside approved roots.

LAB TypeScript Lab: Safe File Path Gate Preview coming soon

LAB 111

TypeScript Lab: Safe File Path Gate

Concept

Path normalization and boundary checks prevent directory traversal.

Concept

Path normalization and boundary checks prevent directory traversal.

Objective & Explanation

What the project should make visible and why the concept matters.

Learning Target

Objective

Allow project files only when resolved paths remain inside approved roots.

Explanation

Path normalization and boundary checks prevent directory traversal.

Project Plan

Structure, technologies, data boundary, and source connection.

Structure

project/
├── package.json
├── tsconfig.json
├── index.html
├── styles.css
└── src/
    └── app.ts

Technologies

TypeScript
HTML
CSS

Data Layer

No persistent data layer. Keep all demonstration values inside the standalone project.

Sandbox Source

src/local-editor/server.ts → safeProjectPath()

Build Instructions

Build only the focused behavior, then use the visual layer to inspect it.

Setup

Create the standalone project folder and listed files.

Implement

Implement the smallest version that demonstrates the concept.

Run & Inspect

Change one input and observe the visible output change.

Code & Configuration

Starter configuration plus the focused implementation example.

Focused TypeScript

Implement this behavior first, then alter the input.

function safeProjectPath(root: string, relativePath: string): string | null {
  const candidate = resolve(root, relativePath);
  const prefix = root.endsWith(sep) ? root : `${root}${sep}`;

  return candidate === root || candidate.startsWith(prefix)
    ? candidate
    : null;
}

Starter Configuration

Keep the project independently buildable.

package.json

{
  "type": "module",
  "scripts": { "build": "tsc" },
  "devDependencies": { "typescript": "^7.0.2" }
}

tsconfig.json

{
  "compilerOptions": {
    "rootDir": "./src",
    "outDir": "./dist",
    "target": "ES2022",
    "module": "ES2022",
    "lib": ["ES2022", "DOM"],
    "strict": true,
    "sourceMap": true
  },
  "include": ["src/**/*.ts"]
}

Expected Visual Result

The output is the proof that the concept is working.

Visible Proof

The browser should visibly demonstrate: allow project files only when resolved paths remain inside approved roots.

Data: None