Change error to 403 Forbidden when outside root

HISTORY.md

@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * Change error to 403 Forbidden when outside root
   * Fix argument type errors to be consistent
   * Fix path traversal vulnerability
   * Use `http-errors` module directly

index.js

@@ -73,7 +73,7 @@ function resolvePath(rootPath, relativePath) {
 
   // path outside root
   if ((path + sep).substr(0, root.length) !== root) {
-    throw createError(400, 'Malicious Path')
+    throw createError(403)
   }
 
   return path

test/resolvePath.js

@@ -52,9 +52,9 @@ describe('resolvePath(relativePath)', function () {
   })
 
   describe('when relativePath resolves outside cwd', function () {
-    it('should throw Malicious Path error', function () {
+    it('should throw Forbidden error', function () {
       assert.throws(resolvePath.bind(null, '../index.js'),
-        expectError(400, 'Malicious Path'))
+        expectError(403, 'Forbidden'))
     })
   })
 })
@@ -129,14 +129,14 @@ describe('resolvePath(rootPath, relativePath)', function () {
   })
 
   describe('when relativePath resolves outside rootPath', function () {
-    it('should throw Malicious Path error', function () {
+    it('should throw Forbidden error', function () {
       assert.throws(resolvePath.bind(null, __dirname, '../index.js'),
-        expectError(400, 'Malicious Path'))
+        expectError(403, 'Forbidden'))
     })
 
     it('should not be tricked by missing separator', function () {
       assert.throws(resolvePath.bind(null, __dirname, join('..', basename(__dirname) + '2', 'index.js')),
-        expectError(400, 'Malicious Path'))
+        expectError(403, 'Forbidden'))
     })
   })
 })