doc: clarify path.isAbsolute is not path traversal mitigation

PR-URL: #57073 Reviewed-By: James M Snell <[email protected]> Reviewed-By: Jordan Harband <[email protected]> Reviewed-By: Antoine du Hamel <[email protected]>
nodejs · Mar 2, 2025 · 97cbefa · 97cbefa
1 parent 4644853
commit 97cbefa
Showing 1 changed file with 7 additions and 5 deletions.
diff --git a/doc/api/path.md b/doc/api/path.md
@@ -317,17 +317,19 @@ added: v0.11.2
 * `path` {string}
 * Returns: {boolean}
 
-The `path.isAbsolute()` method determines if `path` is an absolute path.
+The `path.isAbsolute()` method determines if the literal `path` is absolute.
+Therefore, it’s not safe for mitigating path traversals.
 
 If the given `path` is a zero-length string, `false` will be returned.
 
 For example, on POSIX:
 
 ```js
-path.isAbsolute('/foo/bar'); // true
-path.isAbsolute('/baz/..');  // true
-path.isAbsolute('qux/');     // false
-path.isAbsolute('.');        // false
+path.isAbsolute('/foo/bar');   // true
+path.isAbsolute('/baz/..');    // true
+path.isAbsolute('/baz/../..'); // true
+path.isAbsolute('qux/');       // false
+path.isAbsolute('.');          // false
 ```
 
 On Windows: