flawopen.com/Path Traversal/Go

Path Traversal in Go

Key terms on this page

filepath.Clean

Lexically cleans a path by resolving relative dots, but does not prevent the path from resolving to parent directories (../).

filepath.Rel

Computes the relative path between basepath and targpath. If the result starts with '..', targpath is outside basepath.

What's happening

Go's filepath.Join(uploadDir, filename) calls filepath.Clean on the result. If filename is ../../etc/passwd, filepath.Join produces /etc/passwd if uploadDir is not deeply nested, escaping boundaries.

Real-world impact

Vulnerable vs. fixed

// VULNERABLE: filepath.Join does not prevent directory breakout
package main

import (
	"net/http"
	"os"
	"path/filepath"
)

func downloadHandler(w http.ResponseWriter, r *http.Request) {
	filename := r.URL.Query().Get("file")
	baseDir := "/var/app/public/files"

	// Attacker input: "../../etc/shadow"
	targetPath := filepath.Join(baseDir, filename)

	data, err := os.ReadFile(targetPath)
	if err != nil {
		http.NotFound(w, r)
		return
	}
	w.Write(data)
}

// HARDENED: Use filepath.Rel to verify target is strictly inside baseDir
package main

import (
	"net/http"
	"os"
	"path/filepath"
	"strings"
)

func downloadHandler(w http.ResponseWriter, r *http.Request) {
	filename := r.URL.Query().Get("file")
	baseDir := "/var/app/public/files"

	// 1. Resolve absolute paths
	absBase, err := filepath.Abs(baseDir)
	if err != nil {
		http.Error(w, "Server error", http.StatusInternalServerError)
		return
	}
	absTarget := filepath.Join(absBase, filepath.Clean("/"+filename))

	// 2. Verify relative containment
	rel, err := filepath.Rel(absBase, absTarget)
	if err != nil || strings.HasPrefix(rel, "..") || rel == "." {
		http.Error(w, "Access denied: Path Traversal detected", http.StatusForbidden)
		return
	}

	data, err := os.ReadFile(absTarget)
	if err != nil {
		http.NotFound(w, r)
		return
	}
	w.Write(data)
}

Why the fix works

filepath.Rel(absBase, absTarget) computes the path difference. If absTarget escapes absBase, the relative path must begin with ... Rejecting strings with the .. prefix guarantees the file is contained.

Gotchas

Common misconceptions

How to check if you're affected

Prevention checklist

• ✓Clean paths with filepath.Clean()
• ✓Verify !strings.HasPrefix(rel, "..") using filepath.Rel()
• ✓Resolve symlinks with filepath.EvalSymlinks() where necessary
• ✓Use Go's http.FS or os.DirFS() which enforce chroot-like root boundaries

FAQ

References

• CWE-22 Specification
• OWASP Security Cheat Sheet Series