sc-path-traversal

SC: Path Traversal / Directory Traversal

Purpose

Detects path traversal vulnerabilities where user-controlled input is used to construct file paths, enabling reading, writing, or deleting arbitrary files. Covers ../ traversal, null byte injection, URL-encoded bypasses, zip slip (archive extraction), and symlink attacks.

Activation

Called by sc-orchestrator during Phase 2. Runs against all detected languages.

Phase 1: Discovery

Keyword Patterns to Search

"open(", "readFile(", "readFileSync(", "writeFile(",
"fs.read", "fs.write", "fs.unlink", "os.Open(", "os.ReadFile(",
"file_get_contents(", "fopen(", "include(", "require(",
"Path.Combine(", "Path.Join(", "filepath.Join(",
"os.path.join(", "path.join(", "path.resolve("

Data Flow: User Input → File Path

# VULNERABLE
filename = request.GET['file']
with open(f'/uploads/{filename}') as f:  # ../../../etc/passwd
    return f.read()

# SAFE: Validate resolved path
filename = request.GET['file']
filepath = os.path.realpath(os.path.join('/uploads', filename))
if not filepath.startswith('/uploads/'):
    raise PermissionError()
with open(filepath) as f:
    return f.read()

// VULNERABLE: path.join does NOT prevent traversal
const file = path.join(__dirname, 'uploads', req.params.filename);
// req.params.filename = "../../../etc/passwd" → traversal!

// SAFE: Resolve and verify
const base = path.resolve(__dirname, 'uploads');
const file = path.resolve(base, req.params.filename);
if (!file.startsWith(base + path.sep)) {
  return res.status(403).send('Forbidden');
}

Zip Slip Detection

// VULNERABLE: Archive extraction without path validation
ZipEntry entry = zipInput.getNextEntry();
File file = new File(destDir, entry.getName());  // entry could be ../../evil.sh
Files.copy(zipInput, file.toPath());

// SAFE: Validate extracted path
File file = new File(destDir, entry.getName());
if (!file.getCanonicalPath().startsWith(destDir.getCanonicalPath() + File.separator)) {
    throw new SecurityException("Zip slip detected: " + entry.getName());
}