From 5ae7e9406ed549b89b41e05e5f10ab814003846b Mon Sep 17 00:00:00 2001 From: Thiyagu K Date: Fri, 6 Mar 2026 13:38:38 +0000 Subject: [PATCH 1/4] feat: implement secure path validation for downloadManyFiles - Adds protection against path traversal (../) using normalized path resolution. - Prevents Windows-style drive letter injection while allowing GCS timestamps. - Implements directory jail logic to ensure absolute-style paths are relative to destination. - Preserves backward compatibility by returning an augmented DownloadResponse array. - Automates recursive directory creation for validated nested files. - Adds comprehensive 13-scenario test suite for edge-case parity. --- handwritten/storage/src/file.ts | 16 ++ handwritten/storage/src/transfer-manager.ts | 82 ++++++-- handwritten/storage/test/transfer-manager.ts | 198 ++++++++++++++++++- 3 files changed, 281 insertions(+), 15 deletions(-) diff --git a/handwritten/storage/src/file.ts b/handwritten/storage/src/file.ts index 5c51e63dfb0..28a2ec57f47 100644 --- a/handwritten/storage/src/file.ts +++ b/handwritten/storage/src/file.ts @@ -396,6 +396,22 @@ export interface CopyCallback { export type DownloadResponse = [Buffer]; +export type DownloadResponseWithStatus = [Buffer] & { + skipped?: boolean; + reason?: SkipReason; + fileName?: string; + localPath?: string; + message?: string; + error?: Error; +}; + +export enum SkipReason { + PATH_TRAVERSAL = 'PATH_TRAVERSAL', + ILLEGAL_CHARACTER = 'ILLEGAL_CHARACTER', + ALREADY_EXISTS = 'ALREADY_EXISTS', + DOWNLOAD_ERROR = 'DOWNLOAD_ERROR', +} + export type DownloadCallback = ( err: RequestError | null, contents: Buffer, diff --git a/handwritten/storage/src/transfer-manager.ts b/handwritten/storage/src/transfer-manager.ts index be34c76f08e..25c30aaa2bd 100644 --- a/handwritten/storage/src/transfer-manager.ts +++ b/handwritten/storage/src/transfer-manager.ts @@ -18,9 +18,11 @@ import {Bucket, UploadOptions, UploadResponse} from './bucket.js'; import { DownloadOptions, DownloadResponse, + DownloadResponseWithStatus, File, FileExceptionMessages, RequestError, + SkipReason, } from './file.js'; import pLimit from 'p-limit'; import * as path from 'path'; @@ -571,8 +573,13 @@ export class TransferManager { options.concurrencyLimit || DEFAULT_PARALLEL_DOWNLOAD_LIMIT, ); const promises: Promise[] = []; + const skippedFiles: DownloadResponseWithStatus[] = []; let files: File[] = []; + const baseDestination = path.resolve( + options.prefix || options.passthroughOptions?.destination || '.' + ); + if (!Array.isArray(filesOrFolder)) { const directoryFiles = await this.bucket.getFiles({ prefix: filesOrFolder, @@ -598,16 +605,50 @@ export class TransferManager { [GCCL_GCS_CMD_KEY]: GCCL_GCS_CMD_FEATURE.DOWNLOAD_MANY, }; + const normalizedGcsName = file.name + .replace(/\\/g, path.sep) + .replace(/\//g, path.sep); + + let dest: string; if (options.prefix || passThroughOptionsCopy.destination) { - passThroughOptionsCopy.destination = path.join( + dest = path.join( options.prefix || '', passThroughOptionsCopy.destination || '', - file.name, + normalizedGcsName ); } if (options.stripPrefix) { - passThroughOptionsCopy.destination = file.name.replace(regex, ''); + dest = normalizedGcsName.replace(regex, ''); + } else { + dest = path.join( + options.prefix || '', + passThroughOptionsCopy.destination || '', + normalizedGcsName + ); } + + const resolvedPath = path.resolve(baseDestination, dest); + const relativePath = path.relative(baseDestination, resolvedPath); + const isOutside = relativePath.split(path.sep).includes('..'); + const hasIllegalDrive = /^[a-zA-Z]:/.test(file.name); + + if (isOutside || hasIllegalDrive) { + let reason: SkipReason = SkipReason.DOWNLOAD_ERROR; + if (isOutside) reason = SkipReason.PATH_TRAVERSAL; + else if (hasIllegalDrive) reason = SkipReason.ILLEGAL_CHARACTER; + + const skippedResult = [Buffer.alloc(0)] as DownloadResponseWithStatus; + skippedResult.skipped = true; + skippedResult.reason = reason; + skippedResult.fileName = file.name; + skippedResult.localPath = resolvedPath; + skippedResult.message = `File ${file.name} was skipped due to path validation failure.`; + + skippedFiles.push(skippedResult); + continue; + } + passThroughOptionsCopy.destination = dest; + if ( options.skipIfExists && existsSync(passThroughOptionsCopy.destination || '') @@ -617,20 +658,33 @@ export class TransferManager { promises.push( limit(async () => { - const destination = passThroughOptionsCopy.destination; - if (destination && destination.endsWith(path.sep)) { - await fsp.mkdir(destination, {recursive: true}); - return Promise.resolve([ - Buffer.alloc(0), - ]) as Promise; + try { + const destination = passThroughOptionsCopy.destination; + if ( + destination && + (destination.endsWith(path.sep) || destination.endsWith('/')) + ) { + await fsp.mkdir(destination, {recursive: true}); + return [Buffer.alloc(0)] as DownloadResponse; + } + const resp = (await file.download( + passThroughOptionsCopy + )) as DownloadResponseWithStatus; + resp.skipped = false; + resp.fileName = file.name; + return resp; + } catch (err) { + const errorResp = [Buffer.alloc(0)] as DownloadResponseWithStatus; + errorResp.skipped = true; + errorResp.reason = SkipReason.DOWNLOAD_ERROR; + errorResp.error = err as Error; + return errorResp; } - - return file.download(passThroughOptionsCopy); - }), + }) ); } - - return Promise.all(promises); + const results = await Promise.all(promises); + return [...skippedFiles, ...results]; } /** diff --git a/handwritten/storage/test/transfer-manager.ts b/handwritten/storage/test/transfer-manager.ts index 2582782fa7a..68510e15633 100644 --- a/handwritten/storage/test/transfer-manager.ts +++ b/handwritten/storage/test/transfer-manager.ts @@ -32,6 +32,7 @@ import { DownloadManyFilesOptions, } from '../src/index.js'; import assert from 'assert'; +import {describe, it, beforeEach, before, afterEach, after} from 'mocha'; import * as path from 'path'; import {GaxiosOptions, GaxiosResponse} from 'gaxios'; import {GCCL_GCS_CMD_KEY} from '../src/nodejs-common/util.js'; @@ -39,8 +40,8 @@ import {AuthClient, GoogleAuth} from 'google-auth-library'; import {tmpdir} from 'os'; import fs from 'fs'; import {promises as fsp, Stats} from 'fs'; - import * as sinon from 'sinon'; +import {DownloadResponseWithStatus, SkipReason} from '../src/file.js'; describe('Transfer Manager', () => { const BUCKET_NAME = 'test-bucket'; @@ -350,6 +351,201 @@ describe('Transfer Manager', () => { true ); }); + + it('skips files that attempt path traversal via dot-segments (../) and returns them in skippedFiles', async () => { + const prefix = 'download-directory'; + const maliciousFilename = '../../etc/passwd'; + const validFilename = 'valid.txt'; + + const maliciousFile = new File(bucket, maliciousFilename); + const validFile = new File(bucket, validFilename); + + const downloadStub = sandbox + .stub(validFile, 'download') + .resolves([Buffer.alloc(0)]); + const maliciousDownloadStub = sandbox.stub(maliciousFile, 'download'); + + const result = (await transferManager.downloadManyFiles( + [maliciousFile, validFile], + {prefix} + )) as DownloadResponseWithStatus[]; + + assert.strictEqual(maliciousDownloadStub.called, false); + assert.strictEqual(downloadStub.calledOnce, true); + + const skipped = result.find(r => r.fileName === maliciousFilename); + assert.ok(skipped); + assert.strictEqual(skipped!.skipped, true); + assert.strictEqual(skipped!.reason, SkipReason.PATH_TRAVERSAL); + }); + + it('allows files with relative segments that resolve within the target directory', async () => { + const prefix = 'safe-directory'; + const filename = './subdir/../subdir/file.txt'; + const file = new File(bucket, filename); + + const downloadStub = sandbox + .stub(file, 'download') + .resolves([Buffer.alloc(0)]); + + await transferManager.downloadManyFiles([file], {prefix}); + + assert.strictEqual(downloadStub.calledOnce, true); + }); + + it('prevents traversal when no prefix is provided', async () => { + const maliciousFilename = '../../../traversal.txt'; + const file = new File(bucket, maliciousFilename); + const downloadStub = sandbox.stub(file, 'download'); + + const result = (await transferManager.downloadManyFiles([ + file, + ])) as DownloadResponseWithStatus[]; + + assert.strictEqual(downloadStub.called, false); + assert.strictEqual(result[0].skipped, true); + assert.strictEqual(result[0].reason, SkipReason.PATH_TRAVERSAL); + }); + + it('jails absolute-looking paths with nested segments into the target directory', async () => { + const prefix = './downloads'; + const filename = '/tmp/shady.txt'; + const file = new File(bucket, filename); + const expectedDestination = path.join(prefix, filename); + + const downloadStub = sandbox + .stub(file, 'download') + .resolves([Buffer.alloc(0)]); + + const result = (await transferManager.downloadManyFiles([file], { + prefix, + })) as DownloadResponseWithStatus[]; + + assert.strictEqual(downloadStub.called, true); + const options = downloadStub.firstCall.args[0] as DownloadOptions; + assert.strictEqual(options.destination, expectedDestination); + + assert.strictEqual(result.length, 1); + assert.strictEqual(result[0].skipped, false); + }); + + it('jails absolute-looking Unix paths (e.g. /etc/passwd) into the target directory instead of skipping', async () => { + const prefix = 'downloads'; + const filename = '/etc/passwd'; + const expectedDestination = path.join(prefix, filename); + + const file = new File(bucket, filename); + const downloadStub = sandbox + .stub(file, 'download') + .resolves([Buffer.alloc(0)]); + + const result = (await transferManager.downloadManyFiles([file], { + prefix, + })) as DownloadResponseWithStatus[]; + + assert.strictEqual(downloadStub.calledOnce, true); + const options = downloadStub.firstCall.args[0] as DownloadOptions; + assert.strictEqual(options.destination, expectedDestination); + assert.strictEqual(result[0].skipped, false); + }); + + it('correctly handles stripPrefix and verifies the resulting path is still safe', async () => { + const options = { + stripPrefix: 'secret/', + prefix: 'local-folder', + }; + const filename = 'secret/../../escape.txt'; + const file = new File(bucket, filename); + + const downloadStub = sandbox.stub(file, 'download'); + + const result = (await transferManager.downloadManyFiles( + [file], + options + )) as DownloadResponseWithStatus[]; + + assert.strictEqual(downloadStub.called, false); + assert.strictEqual(result[0].skipped, true); + assert.strictEqual(result[0].reason, SkipReason.PATH_TRAVERSAL); + }); + + it('should skip files containing Windows volume separators (:) to prevent drive-injection attacks', async () => { + const prefix = 'C:\\local\\target'; + const maliciousFile = new File(bucket, 'C:\\system\\win32'); + + const result = (await transferManager.downloadManyFiles([maliciousFile], { + prefix, + })) as DownloadResponseWithStatus[]; + + assert.strictEqual(result.length, 1); + + const response = result[0]; + assert.strictEqual(response.skipped, true); + assert.strictEqual(response.reason, SkipReason.ILLEGAL_CHARACTER); + assert.strictEqual(response.fileName, 'C:\\system\\win32'); + }); + + it('should account for every input file (Parity Check)', async () => { + const prefix = '/local/target'; + const fileNames = [ + 'data/file.txt', // Normal (Download) + 'data/../sibling.txt', // Internal Traversal (Download) + '../escape.txt', // External Traversal (Skip - Path Traversal '..') + '/etc/passwd', // Leading Slash (Download) + '/local/usr/a.txt', // Path matches prefix (Download) + 'dir/./file.txt', // Dot segment (Download) + 'windows\\file.txt', // Windows separator (Download) + 'data\\..\\sibling.txt', // Windows traversal (Download) + '..\\escape.txt', // Windows escape (Skip - Path Traversal '..') + 'C:\\system\\win32', // Windows Drive (Skip - Illegal Char ':') + 'C:\\local\\target\\a.txt', // Windows Absolute (Skip - Illegal Char ':') + '..temp.txt', // Leading dots in filename (Download - Not a traversal) + 'test-2026:01:01.txt', // GCS Timestamps (Download - Colon is middle, not drive) + ]; + + const files = fileNames.map(name => bucket.file(name)); + + sandbox.stub(File.prototype, 'download').resolves([Buffer.alloc(0)]); + sandbox.stub(fsp, 'mkdir').resolves(); + + const result = (await transferManager.downloadManyFiles(files, { + prefix, + })) as DownloadResponseWithStatus[]; + + assert.strictEqual( + result.length, + fileNames.length, + `Parity Failure: Processed ${result.length} files but input had ${fileNames.length}` + ); + + const downloads = result.filter(r => !r.skipped); + const skips = result.filter(r => r.skipped); + + const expectedDownloads = 9; + const expectedSkips = 4; + + assert.strictEqual( + downloads.length, + expectedDownloads, + `Expected ${expectedDownloads} downloads but got ${downloads.length}` + ); + + assert.strictEqual( + skips.length, + expectedSkips, + `Expected ${expectedSkips} skips but got ${skips.length}` + ); + + const traversalSkips = skips.filter( + f => f.reason === SkipReason.PATH_TRAVERSAL + ); + assert.strictEqual(traversalSkips.length, 2); + + const illegalCharSkips = skips.filter( + f => f.reason === SkipReason.ILLEGAL_CHARACTER + ); + assert.strictEqual(illegalCharSkips.length, 2); + }); }); describe('downloadFileInChunks', () => { From 83c28c92e8cb9cfc7abe59189a04fc7998aee816 Mon Sep 17 00:00:00 2001 From: Thiyagu K Date: Tue, 10 Mar 2026 08:08:37 +0000 Subject: [PATCH 2/4] fix double-assignment --- handwritten/storage/src/transfer-manager.ts | 13 +++---------- 1 file changed, 3 insertions(+), 10 deletions(-) diff --git a/handwritten/storage/src/transfer-manager.ts b/handwritten/storage/src/transfer-manager.ts index 25c30aaa2bd..60e5f26c516 100644 --- a/handwritten/storage/src/transfer-manager.ts +++ b/handwritten/storage/src/transfer-manager.ts @@ -610,13 +610,6 @@ export class TransferManager { .replace(/\//g, path.sep); let dest: string; - if (options.prefix || passThroughOptionsCopy.destination) { - dest = path.join( - options.prefix || '', - passThroughOptionsCopy.destination || '', - normalizedGcsName - ); - } if (options.stripPrefix) { dest = normalizedGcsName.replace(regex, ''); } else { @@ -633,9 +626,9 @@ export class TransferManager { const hasIllegalDrive = /^[a-zA-Z]:/.test(file.name); if (isOutside || hasIllegalDrive) { - let reason: SkipReason = SkipReason.DOWNLOAD_ERROR; - if (isOutside) reason = SkipReason.PATH_TRAVERSAL; - else if (hasIllegalDrive) reason = SkipReason.ILLEGAL_CHARACTER; + const reason = isOutside + ? SkipReason.PATH_TRAVERSAL + : SkipReason.ILLEGAL_CHARACTER; const skippedResult = [Buffer.alloc(0)] as DownloadResponseWithStatus; skippedResult.skipped = true; From 57686a9c1b0ab299a9c2f4601e9b1f95aff8d673 Mon Sep 17 00:00:00 2001 From: Thiyagu K Date: Mon, 16 Mar 2026 13:39:02 +0000 Subject: [PATCH 3/4] feat(storage): secure path resolution and preserve result parity - Implemented "jail" logic using path.resolve to prevent traversal. - Neutralized leading slashes in GCS object names. - Pre-allocated results array to maintain 1:1 input/output index parity. - Added automatic recursive directory creation for nested local paths. - Fixed prioritization of destination options in downloadManyFiles. --- handwritten/storage/src/transfer-manager.ts | 76 +++++++++++--------- handwritten/storage/test/transfer-manager.ts | 16 +++-- 2 files changed, 52 insertions(+), 40 deletions(-) diff --git a/handwritten/storage/src/transfer-manager.ts b/handwritten/storage/src/transfer-manager.ts index 60e5f26c516..ae71f6f0bf3 100644 --- a/handwritten/storage/src/transfer-manager.ts +++ b/handwritten/storage/src/transfer-manager.ts @@ -572,12 +572,11 @@ export class TransferManager { const limit = pLimit( options.concurrencyLimit || DEFAULT_PARALLEL_DOWNLOAD_LIMIT, ); - const promises: Promise[] = []; - const skippedFiles: DownloadResponseWithStatus[] = []; + const promises: Promise[] = []; let files: File[] = []; const baseDestination = path.resolve( - options.prefix || options.passthroughOptions?.destination || '.' + options.passthroughOptions?.destination || options.prefix || '.' ); if (!Array.isArray(filesOrFolder)) { @@ -599,30 +598,28 @@ export class TransferManager { : EMPTY_REGEX; const regex = new RegExp(stripRegexString, 'g'); - for (const file of files) { - const passThroughOptionsCopy = { - ...options.passthroughOptions, - [GCCL_GCS_CMD_KEY]: GCCL_GCS_CMD_FEATURE.DOWNLOAD_MANY, - }; + const finalResults: DownloadResponseWithStatus[] = new Array(files.length); + + for (let i = 0; i < files.length; i++) { + const file = files[i]; const normalizedGcsName = file.name - .replace(/\\/g, path.sep) - .replace(/\//g, path.sep); + .replace(/\\/g, '/') + .replace(/^\/+/, ''); let dest: string; if (options.stripPrefix) { dest = normalizedGcsName.replace(regex, ''); } else { - dest = path.join( - options.prefix || '', - passThroughOptionsCopy.destination || '', - normalizedGcsName - ); + dest = normalizedGcsName; } const resolvedPath = path.resolve(baseDestination, dest); - const relativePath = path.relative(baseDestination, resolvedPath); - const isOutside = relativePath.split(path.sep).includes('..'); + const relativeFromBase = path.relative(baseDestination, resolvedPath); + + const isOutside = + path.isAbsolute(relativeFromBase) || + relativeFromBase.split(path.sep).includes('..'); const hasIllegalDrive = /^[a-zA-Z]:/.test(file.name); if (isOutside || hasIllegalDrive) { @@ -635,49 +632,60 @@ export class TransferManager { skippedResult.reason = reason; skippedResult.fileName = file.name; skippedResult.localPath = resolvedPath; - skippedResult.message = `File ${file.name} was skipped due to path validation failure.`; - skippedFiles.push(skippedResult); + finalResults[i] = skippedResult; continue; } - passThroughOptionsCopy.destination = dest; - if ( - options.skipIfExists && - existsSync(passThroughOptionsCopy.destination || '') - ) { + if (options.skipIfExists && existsSync(resolvedPath)) { continue; } + const passThroughOptionsCopy = { + ...options.passthroughOptions, + destination: resolvedPath, + [GCCL_GCS_CMD_KEY]: GCCL_GCS_CMD_FEATURE.DOWNLOAD_MANY, + }; + promises.push( limit(async () => { try { - const destination = passThroughOptionsCopy.destination; - if ( - destination && - (destination.endsWith(path.sep) || destination.endsWith('/')) - ) { + const destination = passThroughOptionsCopy.destination!; + + if (destination.endsWith(path.sep) || destination.endsWith('/')) { await fsp.mkdir(destination, {recursive: true}); - return [Buffer.alloc(0)] as DownloadResponse; + const dirResp = [Buffer.alloc(0)] as DownloadResponseWithStatus; + dirResp.skipped = false; + dirResp.fileName = file.name; + dirResp.localPath = destination; + finalResults[i] = dirResp; + return; } + + await fsp.mkdir(path.dirname(destination), {recursive: true}); + const resp = (await file.download( passThroughOptionsCopy )) as DownloadResponseWithStatus; resp.skipped = false; resp.fileName = file.name; - return resp; + resp.localPath = destination; + finalResults[i] = resp; } catch (err) { const errorResp = [Buffer.alloc(0)] as DownloadResponseWithStatus; errorResp.skipped = true; errorResp.reason = SkipReason.DOWNLOAD_ERROR; + errorResp.fileName = file.name; + errorResp.localPath = resolvedPath; errorResp.error = err as Error; - return errorResp; + finalResults[i] = errorResp; } }) ); } - const results = await Promise.all(promises); - return [...skippedFiles, ...results]; + + await Promise.all(promises); + return finalResults; } /** diff --git a/handwritten/storage/test/transfer-manager.ts b/handwritten/storage/test/transfer-manager.ts index 68510e15633..96306ddf053 100644 --- a/handwritten/storage/test/transfer-manager.ts +++ b/handwritten/storage/test/transfer-manager.ts @@ -325,7 +325,7 @@ describe('Transfer Manager', () => { const file = 'first.txt'; const filesOrFolder = [folder, path.join(folder, file)]; const expectedFilePath = path.join(prefix, folder, file); - const expectedDir = path.join(prefix, folder); + const expectedDir = path.resolve(prefix, folder); const mkdirSpy = sandbox.spy(fsp, 'mkdir'); const download = (optionsOrCb?: DownloadOptions | DownloadCallback) => { if (typeof optionsOrCb === 'function') { @@ -345,9 +345,7 @@ describe('Transfer Manager', () => { prefix: prefix, }); assert.strictEqual( - mkdirSpy.calledOnceWith(expectedDir, { - recursive: true, - }), + mkdirSpy.calledWith(expectedDir, {recursive: true}), true ); }); @@ -411,7 +409,10 @@ describe('Transfer Manager', () => { const prefix = './downloads'; const filename = '/tmp/shady.txt'; const file = new File(bucket, filename); - const expectedDestination = path.join(prefix, filename); + const expectedDestination = path.resolve( + prefix, + filename.replace(/^\/+/, '') + ); const downloadStub = sandbox .stub(file, 'download') @@ -432,7 +433,10 @@ describe('Transfer Manager', () => { it('jails absolute-looking Unix paths (e.g. /etc/passwd) into the target directory instead of skipping', async () => { const prefix = 'downloads'; const filename = '/etc/passwd'; - const expectedDestination = path.join(prefix, filename); + const expectedDestination = path.resolve( + prefix, + filename.replace(/^\/+/, '') + ); const file = new File(bucket, filename); const downloadStub = sandbox From 11ef1aa1e23d53642f2fce64a59771be4d008694 Mon Sep 17 00:00:00 2001 From: Thiyagu K Date: Mon, 16 Mar 2026 14:07:26 +0000 Subject: [PATCH 4/4] feat(storage): prioritize drive check for Windows compatibility - Reordered security checks to catch illegal drive letters before path resolution. - Fixed SkipReason mismatch (Illegal Character vs Path Traversal) on Windows. - Ensured absolute Windows paths are neutralized before traversal validation. --- handwritten/storage/src/transfer-manager.ts | 29 +++++++++++---------- 1 file changed, 15 insertions(+), 14 deletions(-) diff --git a/handwritten/storage/src/transfer-manager.ts b/handwritten/storage/src/transfer-manager.ts index ae71f6f0bf3..3f4a3f2a236 100644 --- a/handwritten/storage/src/transfer-manager.ts +++ b/handwritten/storage/src/transfer-manager.ts @@ -603,16 +603,23 @@ export class TransferManager { for (let i = 0; i < files.length; i++) { const file = files[i]; + const hasIllegalDrive = /^[a-zA-Z]:/.test(file.name); + if (hasIllegalDrive) { + const skippedResult = [Buffer.alloc(0)] as DownloadResponseWithStatus; + skippedResult.skipped = true; + skippedResult.reason = SkipReason.ILLEGAL_CHARACTER; + skippedResult.fileName = file.name; + finalResults[i] = skippedResult; + continue; + } + const normalizedGcsName = file.name .replace(/\\/g, '/') .replace(/^\/+/, ''); - let dest: string; - if (options.stripPrefix) { - dest = normalizedGcsName.replace(regex, ''); - } else { - dest = normalizedGcsName; - } + const dest = options.stripPrefix + ? normalizedGcsName.replace(regex, '') + : normalizedGcsName; const resolvedPath = path.resolve(baseDestination, dest); const relativeFromBase = path.relative(baseDestination, resolvedPath); @@ -620,19 +627,13 @@ export class TransferManager { const isOutside = path.isAbsolute(relativeFromBase) || relativeFromBase.split(path.sep).includes('..'); - const hasIllegalDrive = /^[a-zA-Z]:/.test(file.name); - - if (isOutside || hasIllegalDrive) { - const reason = isOutside - ? SkipReason.PATH_TRAVERSAL - : SkipReason.ILLEGAL_CHARACTER; + if (isOutside) { const skippedResult = [Buffer.alloc(0)] as DownloadResponseWithStatus; skippedResult.skipped = true; - skippedResult.reason = reason; + skippedResult.reason = SkipReason.PATH_TRAVERSAL; skippedResult.fileName = file.name; skippedResult.localPath = resolvedPath; - finalResults[i] = skippedResult; continue; }