diff --git a/doc/api/path.md b/doc/api/path.md index eb558e73592e4d..2c8398c877572d 100644 --- a/doc/api/path.md +++ b/doc/api/path.md @@ -317,17 +317,19 @@ added: v0.11.2 * `path` {string} * Returns: {boolean} -The `path.isAbsolute()` method determines if `path` is an absolute path. +The `path.isAbsolute()` method determines if the literal `path` is absolute. +Therefore, it’s not safe for mitigating path traversals. If the given `path` is a zero-length string, `false` will be returned. For example, on POSIX: ```js -path.isAbsolute('/foo/bar'); // true -path.isAbsolute('/baz/..'); // true -path.isAbsolute('qux/'); // false -path.isAbsolute('.'); // false +path.isAbsolute('/foo/bar'); // true +path.isAbsolute('/baz/..'); // true +path.isAbsolute('/baz/../..'); // true +path.isAbsolute('qux/'); // false +path.isAbsolute('.'); // false ``` On Windows: