prevent access /etc/passwd

path.js

var path = require('path')

var userPath = path.normalize('/var/www/app/abc/../../../../../../../../../../etc/passwd')

if (userPath.indexOf(__dirname) == 0 ) {
  // Valid path
} else {
  // Invalid path
}