flawopen.com/path-traversal/Go

● CWE-918 · 高危
安全研究 · FlawOpen

漏洞深度剖析：Path Traversal in Go

How filepath.Join in Go fails to restrict file boundaries, and how to enforce containment using filepath.Clean and filepath.Rel.

💡 通俗易懂的原理解析 (ELI5)

设想一家酒店的房卡扫描锁原本只允许开启二楼的客房。如果客人在门禁键盘上输入 '../../master-safe'，有缺陷的门锁就会跳出当前楼道，直接打开酒店经理办公室的主保险箱。

核心概念与专有名词

Web Application Security
技术概念 (Web Application Security)：Core architecture component affected by CWE-918.
CWE-918
技术概念 (CWE-918)：Standard Common Weakness Enumeration classification for path-traversal-go.
Defense-in-Depth
技术概念 (Defense-in-Depth)：Multi-layered engineering verification and runtime boundary isolation.

攻击执行流程分解

Step 1

客户端提交文件路径参数

应用程序接口通过 HTTP 参数接收用户指定的文件名、报告路径或静态资源标识。

Step 2

目录遍历序列注入

攻击者在文件名参数中注入相对路径遍历符号（如 '../', '..%2f'）或绝对路径覆盖。

Step 3

文件系统根目录边界逃逸

后端直接将不可信输入与基础目录拼接，未进行规范化绝对路径解析（Canonicalization）与边界校验。

Step 4

敏感文件未授权读取或覆盖

系统运行时打开并回传敏感配置文件（如 /etc/passwd、源码凭证、环境变量密钥），造成数据外泄。

源代码对比：漏洞与安全实现

✕ 存在漏洞的实现
// VULNERABLE: filepath.Join does not prevent directory breakout
package main

import (
	"net/http"
	"os"
	"path/filepath"
)

func downloadHandler(w http.ResponseWriter, r *http.Request) {
	filename := r.URL.Query().Get("file")
	baseDir := "/var/app/public/files"

	// Attacker input: "../../etc/shadow"
	targetPath := filepath.Join(baseDir, filename)

	data, err := os.ReadFile(targetPath)
	if err != nil {
		http.NotFound(w, r)
		return
	}
	w.Write(data)
}
✓ 加固后的安全修复
// HARDENED: Use filepath.Rel to verify target is strictly inside baseDir
package main

import (
	"net/http"
	"os"
	"path/filepath"
	"strings"
)

func downloadHandler(w http.ResponseWriter, r *http.Request) {
	filename := r.URL.Query().Get("file")
	baseDir := "/var/app/public/files"

	// 1. Resolve absolute paths
	absBase, err := filepath.Abs(baseDir)
	if err != nil {
		http.Error(w, "Server error", http.StatusInternalServerError)
		return
	}
	absTarget := filepath.Join(absBase, filepath.Clean("/"+filename))

	// 2. Verify relative containment
	rel, err := filepath.Rel(absBase, absTarget)
	if err != nil || strings.HasPrefix(rel, "..") || rel == "." {
		http.Error(w, "Access denied: Path Traversal detected", http.StatusForbidden)
		return
	}

	data, err := os.ReadFile(absTarget)
	if err != nil {
		http.NotFound(w, r)
		return
	}
	w.Write(data)
}

工程与系统安全加固清单

References