sc-path-traversal

To prevent path traversal vulnerabilities, you must canonicalize user-supplied file paths using realpath or resolve and enforce strict boundary checks to ensure requested files remain inside the allowed directory.

LFI (Local File Inclusion) and RFI (Remote File Inclusion) exploit user input to load unauthorized files, while symlink attacks use symbolic links to escape directory boundaries. All three compromise file access security by manipulating paths.

You can detect zip slip vulnerabilities by scanning code that handles file extraction to verify that resolved archive paths remain strictly within the intended target directory, preventing directory traversal during decompression.

Yes, this detection mechanism analyzes user-supplied file paths across multiple languages and environments, covering LFI, RFI, zip slip, and symlink attacks to identify vulnerable file access patterns.

The best way to integrate path traversal detection into a CI pipeline is to scan code paths handling user-supplied input, verifying that file reads are properly constrained by canonicalization and boundary checks.

Path canonicalization resolves relative references but fails to stop directory traversal without boundary checks because it only normalizes the path; strict validation is required to ensure the resolved path remains inside the allowed directory.