From 6369f0b93fb2e1b3b20e6f11aa69d862a8d6f5c6 Mon Sep 17 00:00:00 2001
From: koehlerb <brian@koehler.ca>
Date: Sun, 20 Sep 2020 11:02:43 -0700
Subject: [PATCH] fix handling of config values that start with . or .. but are
 not actually relative paths; e.g. ".foo" or "..bar" (#2065)

Co-authored-by: Brian Koehler <bkoehler@langara.ca>
---
 packages/configuration/src/index.ts             | 2 +-
 packages/configuration/test/config/default.json | 2 ++
 packages/configuration/test/index.test.ts       | 8 ++++++++
 3 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/packages/configuration/src/index.ts b/packages/configuration/src/index.ts
index 4f6079a560..f67922fdbe 100644
--- a/packages/configuration/src/index.ts
+++ b/packages/configuration/src/index.ts
@@ -25,7 +25,7 @@ export default function init () {
             if (process.env[value]) {
               value = process.env[value];
             }
-            if (value.indexOf('.') === 0 || value.indexOf('..') === 0) {
+            if (value.indexOf('./') === 0 || value.indexOf('../') === 0) {
               // Make relative paths absolute
               value = path.resolve(
                 path.join(config.util.getEnv('NODE_CONFIG_DIR')),
diff --git a/packages/configuration/test/config/default.json b/packages/configuration/test/config/default.json
index ea3280fe15..c336b5d442 100644
--- a/packages/configuration/test/config/default.json
+++ b/packages/configuration/test/config/default.json
@@ -2,6 +2,8 @@
   "port": 3030,
   "environment": "NODE_ENV",
   "path": "../something",
+  "notDotPath": ".dot",
+  "notDotDotPath": "..dotdot",
   "pathFromEnv": "PATH_ENV",
   "unescaped": "\\NODE_ENV",
   "from": "default",
diff --git a/packages/configuration/test/index.test.ts b/packages/configuration/test/index.test.ts
index f22facbc89..99eee0c4c7 100644
--- a/packages/configuration/test/index.test.ts
+++ b/packages/configuration/test/index.test.ts
@@ -64,6 +64,14 @@ describe('@feathersjs/configuration', () => {
     assert.strictEqual(app.get('pathFromEnv'), join(__dirname, 'something'))
   );
 
+  it('does not normalize values that start with . but are not a relative path', () =>
+    assert.strictEqual(app.get('notDotPath'), '.dot')
+  );
+
+  it('does not normalize values that start with .. but are not a relative path', () =>
+    assert.strictEqual(app.get('notDotDotPath'), '..dotdot')
+  );
+
   it('converts environment variables recursively', () =>
     assert.strictEqual(app.get('deeply').nested.env, 'testing')
   );