lib/middleware.js
function doesEscapeRoot(root,file) {
  if (file.indexOf(path.normalize(root+"/")) === 0) return just(file);
  else return nothing();
}
function doesEscapeRoot(root,file) {
  if (file.indexOf(path.normalize(root+"/")) === 0) return just(file);
  else return nothing();
}
function doesEscapeRoot ( root , file ) { if ( file . indexOf ( path . normalize ( root + "/" ) ) === 0 ) return just ( file ) ; else return nothing ( ) ; }
The computed path for the requested file should always have the root as the prefix. When it does not, that means the computed request path is pointing outside of the root, which could be malicious.
The computed path for the requested file should always have the root as the prefix . When it does not that means the computed request path is pointing outside of the root which could be malicious .