Repository navigation
Forward slashes in the cwd option cause "safe directory" check to fail erroneously. #1286
Description
If you specify a value for the cwd option that contains forward slashes, such as c:/path/to/fixtures and then run Testem from a directory higher than that path, the tests will fail with 403 errors, because of this "safe dirs" check
The check will fail for a cwd value that contains forward slashes because one half of the comparison is run through path.resolve (which standardises the slashes), and one half (config.cwd()) isn't:
var filePath = path.resolve(config.resolvePath(uri));
var ext = path.extname(filePath);
var isPathPermitted = filePath.indexOf(config.cwd()) !== -1;
I will submit a pull that wraps the call to config.cwd() in a similar call to path.resolve, I have verified that this resolves the problem in local testing.
Activity
testemGH-1286: Added path resolve of cwd to "safe dir" check.
testemGH-1286: Added "unsafe directory handling" tests.
Merge pull request #1287 from the-t-in-rtf/gh-1286
johanneswuerbach commentedon Oct 26, 2026
Sorry for the very long wait on this one, and thanks for reporting it! The served-file containment check now normalizes the configured
cwdwithpath.resolveand compares withpath.relative(#2104), so acwdwith forward slashes likec:/path/to/fixturesno longer causes false 403s. Closing as outdated. If you still see this on a current testem version, please open a new issue.