fix(tag/include_code): prevent path traversal

[stevenjoezhang]

What does it do?

Issue resolved: #5250

WIP: Not working on Windows

Screenshots

Pull request tasks

• Add test cases for the changes.
• Passed the CI test.

[github-actions]

How to test

git clone -b path-traversal https://github.com/hexojs/hexo.git
cd hexo
npm install
npm test

[coveralls]

Pull Request Test Coverage Report for Build 8707184206

Details

• 25 of 25 (100.0%) changed or added relevant lines in 1 file are covered.
• No unchanged relevant lines lost coverage.
• Overall coverage remained the same at 99.531%

---

Totals
Change from base Build 8706447139:	0.0%
Covered Lines:	9332
Relevant Lines:	9376

---

💛 - Coveralls

[uiolee]

fixed working in windows

by using the method defined in hexo/lib/box/index

hexo/lib/box/index.ts

Lines 232 to 235 in 7b588e7

	function escapeBackslash(path) {
	// Replace backslashes on Windows
	return path.replace(/\\/g, '/');
	}

The base branch was changed.

[github-actions]

How to test

git clone -b path-traversal https://github.com/hexojs/hexo.git
cd hexo
npm install
npm test

[github-actions]

flamegraph

https://14546dbc90b6aff9390ab40e9c78c8b284873810-14-hexo.surge.sh/flamegraph.html
https://14546dbc90b6aff9390ab40e9c78c8b284873810-16-hexo.surge.sh/flamegraph.html
https://14546dbc90b6aff9390ab40e9c78c8b284873810-18-hexo.surge.sh/flamegraph.html

[stevenjoezhang]

WIP: I'll rebase it after #5385 and #5457 merged

Done

[yoshinorin]

I resolved conflict with master branch: c95fba1