flawopen.com/Path Traversal/JavaScript

Path Traversal in JavaScript

Key terms on this page

path.resolve vs path.join

path.join simply concatenates path segments, whereas path.resolve processes segments from right to left until an absolute path is formed.

boundary delimiter

Appending path.sep to the base directory path during prefix checking to prevent partial directory matching (e.g. /uploads_backup vs /uploads).

What's happening

In Node.js, path.join(__dirname, 'public', req.query.file) normalizes relative dots but does NOT constrain the result to the public directory. If the query string contains ../../../../etc/passwd, the resulting path points outside the webroot.

Real-world impact

Vulnerable vs. fixed

// VULNERABLE: path.join allows directory breakout
const express = require('express');
const path = require('path');
const fs = require('fs');

const app = express();
const PUBLIC_DIR = path.join(__dirname, 'public');

app.get('/download', (req, res) => {
  // Attacker input: "../../etc/passwd"
  const targetFile = path.join(PUBLIC_DIR, req.query.file);
  
  // Directly pipes arbitrary system file to response!
  res.sendFile(targetFile);
});

// HARDENED: Canonicalize path and assert prefix with directory separator
const express = require('express');
const path = require('path');
const fs = require('fs');

const app = express();
const PUBLIC_DIR = path.resolve(__dirname, 'public');

app.get('/download', (req, res) => {
  const userInput = req.query.file;
  if (!userInput || typeof userInput !== 'string') {
    return res.status(400).send('Invalid file parameter');
  }

  // 1. Resolve to absolute path
  const safePath = path.resolve(PUBLIC_DIR, userInput);

  // 2. Strict boundary check: must start with base folder + separator
  if (!safePath.startsWith(PUBLIC_DIR + path.sep)) {
    return res.status(403).send('Forbidden: Path Traversal detected');
  }

  // 3. Verify file exists and is a regular file
  fs.stat(safePath, (err, stats) => {
    if (err || !stats.isFile()) return res.status(404).send('File not found');
    res.sendFile(safePath);
  });
});

Why the fix works

path.resolve() resolves all .. sequences to an absolute canonical string. Checking that safePath.startsWith(PUBLIC_DIR + path.sep) guarantees the target file is strictly inside the folder and prevents sibling directory confusion.

Gotchas

Common misconceptions

How to check if you're affected

Prevention checklist

• ✓Resolve absolute paths with path.resolve()
• ✓Enforce safePath.startsWith(baseDir + path.sep)
• ✓Verify typeof req.query.file === 'string' to prevent type confusion / array injection
• ✓Use express.static() with dotfiles: 'ignore' for static file serving

FAQ

References

• CWE-22 Specification
• OWASP Security Cheat Sheet Series