From 83de75296892e4f9514f1da7d1a3f48eae64a148 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 25 Aug 2014 18:51:14 -0400
Subject: [PATCH] Resolve relative paths at middleware setup

fixes #15
---
 HISTORY.md   |  5 +++++
 index.js     |  7 +++++--
 test/test.js | 32 ++++++++++++++++++++------------
 3 files changed, 30 insertions(+), 14 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 969dc3c..06e1a6c 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * Resolve relative paths at middleware setup
+
 1.1.6 / 2014-08-10
 ==================
 
diff --git a/index.js b/index.js
index 695fbfd..7c807a4 100644
--- a/index.js
+++ b/index.js
@@ -24,6 +24,7 @@ var http = require('http')
   , join = path.join;
 var Batch = require('batch');
 var parseUrl = require('parseurl');
+var resolve = require('path').resolve;
 
 /*!
  * Icon cache.
@@ -76,11 +77,13 @@ exports = module.exports = function serveIndex(root, options){
   // root required
   if (!root) throw new TypeError('serveIndex() root path required');
 
+  // resolve root to absolute
+  root = resolve(root);
+
   var hidden = options.hidden
     , icons = options.icons
     , view = options.view || 'tiles'
     , filter = options.filter
-    , root = normalize(root + sep)
     , template = options.template || defaultTemplate
     , stylesheet = options.stylesheet || defaultStylesheet;
 
@@ -101,7 +104,7 @@ exports = module.exports = function serveIndex(root, options){
     var dir = decodeURIComponent(url.pathname)
       , path = normalize(join(root, dir))
       , originalDir = decodeURIComponent(originalUrl.pathname)
-      , showUp = path != root;
+    var showUp = resolve(path) !== root;
 
     // null byte(s), bad request
     if (~path.indexOf('\0')) return next(createError(400));
diff --git a/test/test.js b/test/test.js
index 568fcb2..bc6af74 100644
--- a/test/test.js
+++ b/test/test.js
@@ -1,10 +1,16 @@
 
 var http = require('http');
 var fs = require('fs');
+var path = require('path');
 var request = require('supertest');
 var should = require('should');
 var serveIndex = require('..');
 
+var fixtures = path.join(__dirname, '/fixtures');
+var relative = path.relative(process.cwd(), fixtures);
+
+var skipRelative = ~relative.indexOf('..') || path.resolve(relative) === relative;
+
 describe('serveIndex(root)', function () {
   it('should require root', function () {
     serveIndex.should.throw(/root path required/)
@@ -222,7 +228,7 @@ describe('serveIndex(root)', function () {
   describe('with "filter" option', function () {
     it('should custom filter files', function (done) {
       var seen = false
-      var server = createServer('test/fixtures', {'filter': filter})
+      var server = createServer(fixtures, {'filter': filter})
 
       function filter(name) {
         if (name.indexOf('foo') === -1) return true
@@ -242,7 +248,7 @@ describe('serveIndex(root)', function () {
 
     it('should filter after hidden filter', function (done) {
       var seen = false
-      var server = createServer('test/fixtures', {'filter': filter, 'hidden': false})
+      var server = createServer(fixtures, {'filter': filter, 'hidden': false})
 
       function filter(name) {
         seen = seen || name.indexOf('.') === 0
@@ -261,7 +267,7 @@ describe('serveIndex(root)', function () {
 
   describe('with "icons" option', function () {
     it('should include icons for html', function (done) {
-      var server = createServer('test/fixtures', {'icons': true})
+      var server = createServer(fixtures, {'icons': true})
 
       request(server)
       .get('/')
@@ -468,7 +474,7 @@ describe('serveIndex(root)', function () {
   describe('when setting a custom template', function () {
     var server;
     before(function () {
-      server = createServer('test/fixtures', {'template': __dirname + '/shared/template.html'});
+      server = createServer(fixtures, {'template': __dirname + '/shared/template.html'});
     });
 
     it('should respond with file list', function (done) {
@@ -500,7 +506,7 @@ describe('serveIndex(root)', function () {
   describe('when setting a custom stylesheet', function () {
     var server;
     before(function () {
-      server = createServer('test/fixtures', {'stylesheet': __dirname + '/shared/styles.css'});
+      server = createServer(fixtures, {'stylesheet': __dirname + '/shared/styles.css'});
     });
 
     it('should respond with appropriate embedded styles', function (done) {
@@ -517,7 +523,7 @@ describe('serveIndex(root)', function () {
   describe('when set with trailing slash', function () {
     var server;
     before(function () {
-      server = createServer('test/fixtures/');
+      server = createServer(fixtures + '/');
     });
 
     it('should respond with file list', function (done) {
@@ -533,20 +539,22 @@ describe('serveIndex(root)', function () {
     });
   });
 
-  describe('when set to \'.\'', function () {
+  (skipRelative ? describe.skip : describe)('when set to \'.\'', function () {
     var server;
     before(function () {
       server = createServer('.');
     });
 
     it('should respond with file list', function (done) {
+      var dest = relative.split(path.sep).join('/');
       request(server)
-      .get('/')
+      .get('/' + dest + '/')
       .set('Accept', 'application/json')
       .expect('Content-Type', /json/)
-      .expect(/LICENSE/)
-      .expect(/public/)
-      .expect(/test/)
+      .expect(/users/)
+      .expect(/file #1\.txt/)
+      .expect(/nums/)
+      .expect(/todo\.txt/)
       .expect(200, done)
     });
 
@@ -560,7 +568,7 @@ describe('serveIndex(root)', function () {
 });
 
 function createServer(dir, opts) {
-  dir = dir || 'test/fixtures'
+  dir = dir || fixtures
 
   var _serveIndex = serveIndex(dir, opts)