Sean Wei says to YSITD 這行有問題吧... req.params.name = req.params.name.replace('../', ''); https://github.com/licson0729/Web-Audio-Player/blob/master/index.js#L90