Repository: diegomura/react-pdf
File: src/utils/image.js (JavaScript)

Code before:
import fetch from 'isomorphic-fetch';
import PNG from './png';
import JPEG from './jpeg';
import createCache from './cache';

export const isDangerousLocalPath = (
  filename,
  { safePath = './public' } = {},
) => {
  const path = require('path');
  const absoluteSafePath = path.resolve(safePath);
  const absoluteFilePath = path.resolve(filename);
  return !absoluteFilePath.startsWith(absoluteSafePath);
};

const fetchLocalFile = (src, { safePath, allowDangerousPaths = false } = {}) =>
  new Promise((resolve, reject) => {
    try {
      const {
        protocol,
        auth,
        host,
        port,
        hostname,
        path,
      } = require('url').parse(src);
      const absolutePath = require('path').resolve(path);
      const fs = require('fs');
      if (
        (protocol && protocol !== 'file:') ||
        auth ||
        host ||
        port ||
        hostname
      ) {
        return reject(
          new Error(
            'Cannot fetch local file with non-file protocol, host or auth credentials',
          ),
        );
      }
      if (
        !allowDangerousPaths &&
        isDangerousLocalPath(absolutePath, { safePath })
      ) {
        return reject(new Error(`Cannot fetch dangerous local path: ${path}`));
      }
      fs.readFile(absolutePath, (err, data) => {
        if (err) {
          return reject(err);
        }

Review comment (suggestion):
`url` is not being ignored by rollup currently but would be very easy to add.
I know it's odd for node code, but I try to keep files "isomorphic" (if that really applies here) by using ES6 imports 

Code after:
import path from 'path';
import url from 'url';
import fetch from 'isomorphic-fetch';
import PNG from './png';
import JPEG from './jpeg';
import createCache from './cache';

export const getAbsoluteLocalPath = src => {
  if (BROWSER) {
    throw new Error('Cannot check local paths in client-side environment');
  }

  const { protocol, auth, host, port, hostname, path: pathname } = url.parse(
    src,
  );
  const absolutePath = path.resolve(pathname);
  if ((protocol && protocol !== 'file:') || auth || host || port || hostname) {
    return undefined;
  }
  return absolutePath;
};

export const isDangerousLocalPath = (
  filename,
  { safePath = './public' } = {},
) => {
  if (BROWSER) {
    throw new Error(
      'Cannot check dangerous local path in client-side environemnt',
    );
  }
  const absoluteSafePath = path.resolve(safePath);
  const absoluteFilePath = path.resolve(filename);
  return !absoluteFilePath.startsWith(absoluteSafePath);
};

const fetchLocalFile = (src, { safePath, allowDangerousPaths = false } = {}) =>
  new Promise((resolve, reject) => {
    try {
      if (BROWSER) {
        return reject(new Error('Cannot fetch local file in this environemnt'));
      }
      const absolutePath = getAbsoluteLocalPath(src);
      if (!absolutePath) {
        return reject(new Error(`Cannot fetch non-local path: ${src}`));
      }
      if (
        !allowDangerousPaths &&
        isDangerousLocalPath(absolutePath, { safePath })
      ) {
        return reject(new Error(`Cannot fetch dangerous local path: ${src}`));