429
}
430
if (!isAbsolute && device === undefined && path.includes(':')) {
431
>
// If the original path was not absolute and if we have not been able to
path.ts
432
>
// resolve it relative to a particular device, we need to ensure that the
433
>
// `tail` has not become something that Windows might interpret as an
434
>
// absolute path. See CVE-2024-36139.
435
>
if (tail.length >= 2 &&
436
>
isWindowsDeviceRoot(tail.charCodeAt(0)) &&
437
>
tail.charCodeAt(1) === CHAR_COLON) {
438
return `.\\${tail}`;
439
}
440
>
let index = path.indexOf(':');
path.ts
441
>
do {
442
>
if (index === len - 1 || isPathSeparator(path.charCodeAt(index + 1))) {
443
return `.\\${tail}`;
444
}
445
>
} while ((index = path.indexOf(':', index + 1)) !== -1);
path.ts
446
>
}
447
if (device === undefined) {
448
return isAbsolute ? `\\${tail}` : tail;