Everyone's talking about it but nobody did it, so I did.
or, the person who should do it should do it and not rely on others to do their job for them?
it's not their job. there's a reason anyone can do it.
Seems like your fix[1] for this is a bit fast. You are already importing `path` in that file. Also, you can do this with just one `path.relative`. Lastly, the url package method you are using is deprecated[2].
This fix does not even work on windows. You can still request data on a different drive.
A simpler fix might be to canonicalize (i.e. no "..") the public folder path and the requested file path and then ensure the public path is a prefix of the other.
Any fix also needs to be sure to resolve any symlinks before doing a prefix check.