path-traversal-prevention

name	path-traversal-prevention
description	When copying files or serving content, user-controlled paths can escape the intended directory:
lastReviewed	2026-04-30T00:00:00.000Z

Path Traversal Prevention

The Problem

When copying files or serving content, user-controlled paths can escape the intended directory:

// Vulnerable: attacker controls filename
const dest = path.join(uploadDir, req.body.filename);
// If filename is "../../../etc/passwd", dest escapes uploadDir

The Solution

Validate that resolved paths stay within the intended root:

function safeJoin(root, userPath) {
  const resolved = path.resolve(root, userPath);
  const normalized = path.normalize(resolved);
  
  // Ensure result is still within root
  if (!normalized.startsWith(path.normalize(root) + path.sep) && 
      normalized !== path.normalize(root)) {
    throw new Error('Path traversal attempt detected');
  }
  
  return normalized;
}

// Usage
try {
  const safePath = safeJoin('/uploads', userFilename);
  // Safe to use safePath
} catch (err) {
  res.status(400).json({ error: 'Invalid filename' });
}

For Directory Trees

When recursively copying directories:

async function safeCopyTree(src, dest, allowedRoot) {
  const entries = await fs.readdir(src, { withFileTypes: true });
  
  for (const entry of entries) {
    const srcPath = path.join(src, entry.name);
    const destPath = path.join(dest, entry.name);
    
    // Validate destination stays in bounds
    const resolvedDest = path.resolve(destPath);
    if (!resolvedDest.startsWith(path.resolve(allowedRoot))) {
      throw new Error(`Path escape: ${entry.name}`);
    }
    
    if (entry.isDirectory()) {
      await fs.mkdir(destPath, { recursive: true });
      await safeCopyTree(srcPath, destPath, allowedRoot);
    } else {
      await fs.copyFile(srcPath, destPath);
    }
  }
}

Common Attack Patterns

Pattern	What It Does
../	Parent directory
..\\	Parent on Windows
....//	Bypass naive ../ filter
%2e%2e%2f	URL-encoded ../
..%c0%af	Overlong UTF-8 encoding

Verification

const attacks = [
  '../etc/passwd',
  '..\\windows\\system32',
  'foo/../../bar',
  'normal/path/file.txt'  // Should pass
];

attacks.forEach(p => {
  try {
    const result = safeJoin('/uploads', p);
    console.log(`OK: ${p} -> ${result}`);
  } catch (e) {
    console.log(`BLOCKED: ${p}`);
  }
});

When to Apply

• File upload handlers
• Static file servers
• Archive extraction (zip, tar)
• Template file loading
• Any path from user input

Tags

security path-traversal file-system input-validation