some fixes for path traversal

Author: chargome

src/docTree.spec.ts

@@ -203,12 +203,24 @@ describe('docTree', () => {
     });
 
     test('should not return siblings for root platform or guide paths', () => {
-      expect(
-        getNextNode(createNode('platforms/javascript', 'JavaScript'))
-      ).toBeUndefined();
-      expect(
-        getNextNode(createNode('platforms/javascript/guides/nextjs', 'Next.js'))
-      ).toBeUndefined();
+      const platforms = createNode('platforms', 'Platforms');
+      const js = createNode('platforms/javascript', 'JavaScript');
+      const python = createNode('platforms/python', 'Python');
+      platforms.children = [js, python];
+      platforms.children.forEach(child => {
+        child.parent = platforms;
+      });
+
+      const nextjs = createNode('platforms/javascript/guides/nextjs', 'Next.js');
+      const angular = createNode('platforms/javascript/guides/angular', 'Angular');
+      js.children = [nextjs, angular];
+      js.children.forEach(child => {
+        child.parent = js;
+      });
+
+      expect(getNextNode(js)).toBeUndefined();
+      expect(getNextNode(nextjs)).toBeUndefined();
+      expect(getNextNode(angular)).toBeUndefined();
     });
   });
 
@@ -259,12 +271,37 @@ describe('docTree', () => {
     });
 
     test('should not return siblings for root platform or guide paths', () => {
-      expect(
-        getPreviousNode(createNode('platforms/javascript', 'JavaScript'))
-      ).toBeUndefined();
-      expect(
-        getPreviousNode(createNode('platforms/javascript/guides/nextjs', 'Next.js'))
-      ).toBeUndefined();
+      const platforms = createNode('platforms', 'Platforms');
+      const js = createNode('platforms/javascript', 'JavaScript');
+      const python = createNode('platforms/python', 'Python');
+      platforms.children = [js, python];
+      platforms.children.forEach(child => {
+        child.parent = platforms;
+      });
+
+      const nextjs = createNode('platforms/javascript/guides/nextjs', 'Next.js');
+      const angular = createNode('platforms/javascript/guides/angular', 'Angular');
+      js.children = [nextjs, angular];
+      js.children.forEach(child => {
+        child.parent = js;
+      });
+
+      expect(getPreviousNode(js)).toBe(undefined);
+      expect(getPreviousNode(python)).toBe(undefined);
+      expect(getPreviousNode(nextjs)).toBe(undefined);
+      expect(getPreviousNode(angular)).toBe(undefined);
+    });
+
+    test('should not return /platforms as previous page', () => {
+      const docs = createNode('', 'Docs');
+      const platforms = createNode('platforms', 'Platforms');
+      const accounts = createNode('accounts', 'Accounts');
+      docs.children = [platforms, accounts];
+      docs.children.forEach(child => {
+        child.parent = docs;
+      });
+
+      expect(getPreviousNode(accounts)).toBe(undefined);
     });
   });
 

src/docTree.ts

@@ -156,22 +156,22 @@ export function nodeForPath(node: DocNode, path: string | string[]): DocNode | u
 export const getNextNode = (node: DocNode): DocNode | undefined => {
   const children = node.children.filter(filterVisibleSiblings).sort(sortSiblingsByOrder);
   // Check for children first
-  if (children.length > 0) {
+  if (
+    children.length > 0 &&
+    !isRootPlatformPath(children[0].path) &&
+    !isRootGuidePath(children[0].path)
+  ) {
     return children[0];
   }
 
   // If no children, look for siblings or parent siblings
   let currentNode: DocNode | undefined = node;
   while (currentNode?.parent) {
-    if (
-      isRootPlatformPath(currentNode.parent.path) ||
-      isRootGuidePath(currentNode.parent.path)
-    ) {
-      return undefined;
-    }
-
     const nextSibling = getNextSiblingNode(currentNode);
     if (nextSibling) {
+      if (isRootPlatformPath(nextSibling.path) || isRootGuidePath(nextSibling.path)) {
+        return undefined;
+      }
       return nextSibling;
     }
     currentNode = currentNode.parent;
@@ -186,8 +186,15 @@ export const getNextNode = (node: DocNode): DocNode | undefined => {
  * the previous sibling, or the previous sibling of a parent node.
  */
 export const getPreviousNode = (node: DocNode): DocNode | undefined => {
+  if (isRootPlatformPath(node.path) || isRootGuidePath(node.path)) {
+    return undefined;
+  }
+
   const previousSibling = getPreviousSiblingNode(node);
   if (previousSibling) {
+    if (previousSibling.path === 'platforms') {
+      return undefined;
+    }
     return previousSibling;
   }
   return node.parent;