path-traversal-anti-pattern

Detect path traversal vulnerabilities by analyzing file path manipulation logic for insecure user input concatenation. Apply path canonicalization and input validation to secure file reads, writes, and static content serving.

A CWE-22 path traversal vulnerability occurs when user input is directly concatenated into file paths without validation. This allows attackers to manipulate filenames to access or modify sensitive system files outside the intended directory.

Secure file upload paths against directory traversal by validating user-provided filenames and applying path canonicalization. Review code handling file uploads to ensure user input cannot be manipulated to access system files.

Static content serving requires input validation to prevent file access exploits. Analyze static serving logic to ensure user-provided filenames cannot be manipulated to traverse directories and access sensitive system files.

The best way to sanitize file paths from user input is combining input validation with path canonicalization. Avoid insecure concatenation of user input into file paths, using secure alternatives to ensure file access remains within intended directories.