remediation-config

Remediation: Configuration & Deployment Vulnerabilities

Actionable fix patterns for configuration-related security vulnerabilities.

When to Use This Skill

• Fixing path traversal - After finding directory escape vulnerabilities
• Fixing debug mode - After finding debug enabled in production
• Fixing security headers - After finding missing headers
• Code review feedback - Provide remediation guidance with examples

When NOT to Use This Skill

• Detecting vulnerabilities - Use vulnerability-patterns skill
• Fixing injection issues - Use remediation-injection skill
• Fixing crypto issues - Use remediation-crypto skill
• Fixing auth issues - Use remediation-auth skill

---

Path Traversal (CWE-22)

Problem

User-controlled file paths can escape intended directories to access sensitive files.

Python

Don't:

# VULNERABLE: Direct path concatenation
def get_file(filename):
    return open(f'/app/uploads/{filename}').read()

# VULNERABLE: No validation
path = os.path.join(base_dir, user_filename)

Do:

# SECURE: Validate path is within allowed directory
from pathlib import Path

UPLOAD_DIR = Path('/app/uploads').resolve()

def safe_file_access(filename: str) -> Path:
    # Resolve to absolute path
    requested = (UPLOAD_DIR / filename).resolve()

    # Verify it's within allowed directory
    if not requested.is_relative_to(UPLOAD_DIR):
        raise ValueError("Path traversal attempt detected")

    return requested

# SECURE: Alternative with os.path
def safe_file_access_os(filename):
    base = os.path.abspath(UPLOAD_DIR)
    requested = os.path.abspath(os.path.join(UPLOAD_DIR, filename))

    if not requested.startswith(base + os.sep):
        raise ValueError("Path traversal attempt detected")

    return requested

JavaScript/Node.js

Don't:

// VULNERABLE: Direct path join
const filepath = path.join(uploadDir, userFilename);
fs.readFile(filepath);

Do:

// SECURE: Validate path is within directory
const path = require('path');
const fs = require('fs');

const UPLOAD_DIR = path.resolve('/app/uploads');

function safeFilePath(filename) {
  const requested = path.resolve(UPLOAD_DIR, filename);

  if (!requested.startsWith(UPLOAD_DIR + path.sep)) {
    throw new Error('Path traversal attempt detected');
  }

  return requested;
}