fix bug on isUnderFileRoot (#881)

* fix bug on isUnderFileRoot

* fix bug

* fix bug

* Update test/swagger/fileLoaderTest.ts

Co-authored-by: Mike Kistler <mikekistler@microsoft.com>

* fix lint

* add changelog

* Update ChangeLog.md

Co-authored-by: v-tianxi@microsoft.com <v-tian@microsoft.com>
Co-authored-by: Mike Kistler <mikekistler@microsoft.com>
Co-authored-by: Ray Chen <raychen@microsoft.com>

ChangeLog.md

@@ -5,6 +5,7 @@
 - GenerateExamples - Add title and operationId to example
 - GenerateExamples - Generate subscriptionId in guid format
 - ModelValidator - Add type validation for additionalProperties whose type is specified as an object
+- Bugfix: FileLoader - isUnderFileRoot function supports validation for absolute path
 - API Scenario
   - Add roleAssignment step
   - Bugfix: Use content-type specified in swagger

lib/swagger/fileLoader.ts

@@ -82,6 +82,11 @@ export class FileLoader implements Loader<string> {
     if (!this.opts.fileRoot) {
       return true;
     }
+
+    if (path.isAbsolute(filePath) && !filePath.startsWith(this.opts.fileRoot)) {
+      return false;
+    }
+
     filePath = pathJoin(this.opts.fileRoot, filePath);
     return filePath.startsWith(this.opts.fileRoot);
   }

test/swagger/fileLoaderTest.ts

@@ -0,0 +1,18 @@
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for license information.
+
+import assert from "assert";
+import { FileLoader, FileLoaderOption } from "../../lib/swagger/fileLoader";
+
+describe("FileLoader functions", () => {
+  describe("isUnderFileRoot", () => {
+    it("should check absolute paths correctly", () => {
+      const options: FileLoaderOption = {
+        fileRoot: `${__dirname}/Azure/oav/test/liveValidation/swaggers/specification`,
+      };
+      const loader = new FileLoader(options);
+      const received = loader.isUnderFileRoot(`${__dirname}/Azure/oav/readme.md`);
+      assert.strictEqual(received, false);
+    });
+  });
+});