From 2259ee18d1de896908e5c1a9a17eb93da9e166d0 Mon Sep 17 00:00:00 2001
From: Jesse Chan <jc@linux.com>
Date: Sun, 11 Oct 2020 18:14:29 +0800
Subject: [PATCH] server: fileUtil: getDirectoryList: assert typeof inputPath
 is string

---
 server/util/fileUtil.ts | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/server/util/fileUtil.ts b/server/util/fileUtil.ts
index 5f3be8c1..17bda2c9 100644
--- a/server/util/fileUtil.ts
+++ b/server/util/fileUtil.ts
@@ -10,6 +10,12 @@ export const accessDeniedError = () => {
   return error;
 };
 
+export const fileNotFoundError = () => {
+  const error = new Error() as NodeJS.ErrnoException;
+  error.code = 'ENOENT';
+  return error;
+};
+
 export const isAllowedPath = (resolvedPath: string) => {
   if (config.allowedPaths == null) {
     return true;
@@ -43,7 +49,11 @@ export const createDirectory = (directoryPath: string) => {
 };
 
 export const getDirectoryList = async (inputPath: string) => {
-  const sourcePath = (inputPath || '/').replace(/^~/, homedir());
+  if (typeof inputPath !== 'string') {
+    throw fileNotFoundError();
+  }
+
+  const sourcePath = inputPath.replace(/^~/, homedir());
 
   const resolvedPath = sanitizePath(sourcePath);
   if (!isAllowedPath(resolvedPath)) {