fix(fetch): path traversal attack

Author: gutenye

src/fetch/__tests__/fetchUtils.test.ts

@@ -34,14 +34,28 @@ describe('request', () => {
   })
 })
 
-describe('createRequest', async () => {
-  const api = createRequest(BASE_URL)
-  expect(await api('/a')).toEqual([
-    `${BASE_URL}/a`,
-    {
-      headers: {
-        'Content-Type': 'application/json',
+describe('createRequest', () => {
+  it('works', async () => {
+    const api = createRequest(BASE_URL)
+    expect(await api('/a')).toEqual([
+      new URL(`${BASE_URL}/a`),
+      {
+        headers: {
+          'Content-Type': 'application/json',
+        },
+      },
+    ])
+  })
+
+  it('path traversal attack', async () => {
+    const api = createRequest(BASE_URL)
+    expect(await api('/../a')).toEqual([
+      new URL(`${BASE_URL}/a`),
+      {
+        headers: {
+          'Content-Type': 'application/json',
+        },
       },
-    },
-  ])
+    ])
+  })
 })

src/fetch/fetch.ts

@@ -37,7 +37,7 @@ export function createRequest(baseUrl: string) {
   ) {
     const newInput =
       typeof input === 'string' && input.startsWith('/')
-        ? `${baseUrl}${input}`
+        ? new URL(input, baseUrl)
         : input
     return request(newInput, options)
   }