code: function getFilePathFromUrl(url, basePath, { pathLib = path } = {}) {
    if (!basePath) {
      throw new Error('basePath must be specified');
    }
    if (!pathLib.isAbsolute(basePath)) {
      throw new Error(`${basePath} is invalid - must be absolute`);
    }
  
    const relativePath = url.split('?')[0];
  
    if (relativePath.indexOf('../') > -1) {
      // any path attempting to traverse up the directory should be rejected
      return 'dummy';
    }
  
    const absolutePath = pathLib.join(basePath, relativePath);
    if (
      !absolutePath.startsWith(basePath) || // if the path has broken out of the basePath, it should be rejected
      absolutePath.endsWith(pathLib.sep) // only files (not folders) can be served
    ) {
      return 'dummy';
    }
  
    return absolutePath;
  }
docs: Safely get the path for a file in the project directory, or reject by returning "dummy"
  
  @param {string} url
  @param {string} basePath - absolute path to base directory
  @param {object} [pathLib=path] - path library, override for testing
  @return {string} - will return 'dummy' if the path is bad