path-traversal-prevention

Path Traversal Prevention

Path traversal attacks occur when user-controlled input is used to construct file paths, allowing attackers to access files outside the intended directory. This can lead to unauthorized file access, data leakage, or system compromise.

1. Do Not Use User Input in File Paths

Rule: Never use raw user input to construct file paths for read or write operations.

❌ Dangerous Examples

# File Read - DANGEROUS
filename = request.args.get('file')
with open(f"/uploads/{filename}", 'r') as f:  # User can access ../../../etc/passwd
    content = f.read()

# File Write - DANGEROUS  
user_file = request.files['file']
filename = user_file.filename
user_file.save(f"/uploads/{filename}")  # User can write to ../../../sensitive/config.json

// File Read - DANGEROUS
const filename = req.query.file;
fs.readFile(`./uploads/${filename}`, (err, data) => {  // ../../../etc/passwd
    res.send(data);
});

// File Write - DANGEROUS
const filename = req.body.filename;
fs.writeFile(`./uploads/${filename}`, data);  // ../../../system/config

// File Read - DANGEROUS
$filename = $_GET['file'];
$content = file_get_contents("/uploads/" . $filename);  // ../../../etc/passwd

// File Write - DANGEROUS
$filename = $_POST['filename'];
file_put_contents("/uploads/" . $filename, $data);  // ../../../sensitive/data

✅ Secure Alternatives

# File Read - SECURE
import os
from pathlib import Path

filename = request.args.get('file')
# Validate filename format
if not filename or not filename.replace('.', '').replace('_', '').replace('-', '').isalnum():
    abort(400, "Invalid filename")

# Use pathlib for safe path joining
upload_dir = Path("/uploads")
file_path = upload_dir / filename

# Ensure the final path is within the intended directory
if not str(file_path.resolve()).startswith(str(upload_dir.resolve())):
    abort(403, "Access denied")

with open(file_path, 'r') as f:
    content = f.read()

// File Read - SECURE
const path = require('path');
const fs = require('fs');

const filename = req.query.file;
// Validate filename
if (!filename || !/^[a-zA-Z0-9._-]+$/.test(filename)) {
    return res.status(400).send('Invalid filename');
}

const uploadDir = path.resolve('./uploads');
const filePath = path.join(uploadDir, filename);

// Ensure path is within intended directory
if (!filePath.startsWith(uploadDir)) {
    return res.status(403).send('Access denied');
}

fs.readFile(filePath, (err, data) => {
    if (err) return res.status(404).send('File not found');
    res.send(data);
});