add test for .. and update deps to fix

Author: joehand

package.json

@@ -19,17 +19,17 @@
   "author": "Joe Hand <[email protected]>",
   "license": "MIT",
   "dependencies": {
-    "dat-ignore": "^2.1.1",
-    "dat-link-resolve": "^2.2.0",
+    "dat-ignore": "^2.1.2",
+    "dat-link-resolve": "^2.3.0",
     "dat-storage": "^1.1.1",
     "dat-swarm-defaults": "^1.0.2",
     "debug": "^4.1.0",
-    "discovery-swarm": "^5.1.2",
-    "hyperdrive": "^9.14.2",
-    "hyperdrive-http": "^4.3.3",
+    "discovery-swarm": "^5.1.4",
+    "hyperdrive": "^9.14.5",
+    "hyperdrive-http": "^4.4.0",
     "hyperdrive-network-speed": "^2.1.0",
     "mirror-folder": "^3.0.0",
-    "random-access-file": "^2.0.1",
+    "random-access-file": "^2.1.1",
     "random-access-memory": "^3.1.1",
     "sparse-bitfield": "^3.0.3",
     "speedometer": "^1.1.0",
@@ -40,13 +40,11 @@
     "count-files": "^2.6.2",
     "dat-encoding": "^5.0.0",
     "dependency-check": "^3.2.0",
-    "memdb": "^1.3.1",
-    "memdown": "^3.0.0",
     "mkdirp": "^0.5.1",
-    "nyc": "^13.1.0",
+    "nyc": "^13.3.0",
     "rimraf": "^2.6.3",
-    "standard": "^12.0.1",
-    "tape": "^4.9.1",
+    "standard": "*",
+    "tape": "^4.10.1",
     "temporary-directory": "^1.0.2"
   },
   "keywords": [

test/importing.js

@@ -195,3 +195,27 @@ test('importing: import from hidden folder src', function (t) {
     })
   })
 })
+
+test('importing: make sure importing .. fails', function (t) {
+  tmpDir(function (_, dir, cleanup) {
+    var illegalDir = path.join(dir, '..', 'tmp')
+    fs.mkdirSync(illegalDir)
+    fs.writeFileSync(path.join(illegalDir, 'hello.txt'), 'hello world')
+    Dat(dir, { temp: true }, function (err, dat) {
+      t.error(err, 'no error')
+      dat.importFiles(function (err) {
+        t.error(err)
+        dat.archive.readdir('/', function (err, list) {
+          t.error(err, 'no error')
+          t.ok(list.length === 0, 'no files added')
+          rimraf.sync(illegalDir)
+          dat.close(function () {
+            cleanup(function () {
+              t.end()
+            })
+          })
+        })
+      })
+    })
+  })
+})