Node.js — Map a URL to a File, Safely

Node.jsBackendPathsSecurity

A request for /css/app.css must turn into a file path inside the folder tinyserve serves.
A request for /../../etc/passwd must not. This mistake, path traversal, has leaked files
from real servers for decades, and it is exactly where naive string handling fails.

Your task

Write resolveInRoot(root, urlPath) with the [`node:path`](https://nodejs.org/api/path.html)
module.

root is an absolute folder, e.g. '/srv/site' (it may end with a slash).
urlPath is the already-decoded path of the request; it always starts with /.
Return the absolute, normalized path of the target (no ., .., double or trailing

slash — what path.resolve produces), or null when it is not inside root.

root itself is inside: '/' maps to '/srv/site'.
A path containing a NUL character (\0) returns null.

Traps the tests check

resolveInRoot('/srv/site', '/etc/passwd');          // '/srv/site/etc/passwd' — not '/etc/passwd'
resolveInRoot('/srv/site', '/../site-backup/db');   // null — '/srv/site-backup' starts with '/srv/site'!
resolveInRoot('/srv/site', '/..config');            // '/srv/site/..config' — a normal file name

path.resolve(root, '/etc/passwd') returns /etc/passwd: an absolute argument wins.
full.startsWith(root) accepts the sibling folder /srv/site-backup. Compare with

path.relative(root, full) instead.

Sample tests

Test #1Plain file

Input: ["/srv/site","/index.html"]

Output: "/srv/site/index.html"

Test #2.. that stays inside

Input: ["/srv/site","/css/../js/app.js"]

Output: "/srv/site/js/app.js"

Test #3Absolute-looking path stays inside

Input: ["/srv/site","/etc/passwd"]

Output: "/srv/site/etc/passwd"

Test #4Escapes root

Input: ["/srv/site","/../etc/passwd"]

Output: null

Test #5Sibling folder sharing the prefix

Input: ["/srv/site","/../site-backup/db.sql"]

Output: null