Repository navigation
[question] Why does simpleSitemapAndIndex destinationDir option now need to be a relative path? #478
Description
8.0.3 — Security Patch
BB-04: Reject absolute destinationDir paths in simpleSitemapAndIndex to prevent arbitrary file writes — passing an absolute path (e.g. /tmp/sitemaps) now throws immediately with a descriptive error
This recently bit me.
I don't understand why this option cannot be an absolute path.
EDIT: I'm using simpleSitemapAndIndex on a server, not in a browser.
Activity
maru1009 commentedon Mar 5, 2026
It’s about safe defaults for server apps where destinationDir can accidentally come from user input. Allowing absolute paths made it possible to turn that into an arbitrary write location.
simpleSitemapAndIndex is now intentionally opinionated: relative paths only. If your server setup is trusted and you need absolute paths, us SitemapAndIndexStream (lower-level API) and enforce your own allowlisted base directory.
Also, good catch: some docs still mention absolute paths; that should be updated for consistency.
timbowhite commentedon Mar 5, 2026
IMO this is extreme edge-case usage and is causing a big trade-off on this module's usability.
And yet this does not prevent writing to any arbitrary subdirectory of the current working directory, no?
Which docs exactly mention absolute paths?
Also, @maru1009 are you a real human being?
maru1009 commentedon Mar 6, 2026
The is safe-default tradeoff: prioritize reducing dangerous outcomes over convenience in the high-level helper API.
Yes. But it reduces
any writable absolute path on hosttopaths under the process working directoryapi.md more specifically line 166 and 214.
And for the last question. It is up to you. :)
timbowhite commentedon Mar 6, 2026
OK.
@derduher Please don't include breaking changes in patch releases (i.e. 8.0.2 -> 8.0.3 is a breaking change).
derduher commentedon Mar 18, 2026
@timbowhite apologies. I had some shaky reason to think it was ok to change to relative . On the balance I thought it safer than allowing the vulnerability to remain.
robogeek commentedon Jul 18, 2026
This bit me today. The double problem is that the validation function also rejects path traversal.
In the meantime this documentation page doesn't reflect reality: https://github.com/ekalinin/sitemap.js/blob/c7f6ac1f6dd1d6c9e9ba03eb3c72e683636b4bac/api.md#simplesitemapandindex
docs: bring api.md, CHANGELOG and parser JSDoc up to date for the nex…