How to fix Path Traversal

What an attacker can do

The concrete impact of leaving Path Traversal unpatched.

How to fix Path Traversal

5 ordered steps. Apply them in order — each builds on the previous.

1. 1

   Use a strict allow-list of filenames if possible

   If the user is choosing from a known set of files (a documentation viewer, a localized template loader), don't accept the raw filename — accept an opaque ID and look up the path server-side.

   This is the only path-traversal-proof design: if the user can't supply a path, they can't traverse one. Use it whenever feasible.

   javascriptStep 1

   // ❌ User provides filename directly
   app.get("/docs/:lang", (req, res) => {
     res.sendFile(`/var/docs/${req.params.lang}.md`);
   });
   
   // ✅ User picks from an allow-list
   const ALLOWED_LANGS = new Set(["en", "pl", "de", "fr", "es"]);
   app.get("/docs/:lang", (req, res) => {
     if (!ALLOWED_LANGS.has(req.params.lang)) {
       return res.status(404).send("Not found");
     }
     res.sendFile(`/var/docs/${req.params.lang}.md`);
   });

2. 2

   Canonicalize the path and verify the prefix

   When you must accept user-controlled paths (legitimate uploads, generated reports), resolve to absolute path and check it starts with your base directory.

   Use `path.resolve()` (Node), `os.path.realpath()` (Python), `filepath.Clean` + `filepath.IsAbs` (Go), `realpath()` (PHP). All of these handle `..`, multiple slashes, and absolute-path injection. Then string-prefix-check against your base.

   javascriptStep 2

   import path from "node:path";
   import fs from "node:fs/promises";
   
   const UPLOAD_DIR = path.resolve("/var/uploads");
   
   async function readUpload(userFilename) {
     // Resolve to absolute path
     const requested = path.resolve(UPLOAD_DIR, userFilename);
   
     // Verify it stays inside UPLOAD_DIR (with separator to avoid prefix attacks
     // where /var/uploads-evil/ prefix-matches /var/uploads)
     if (!requested.startsWith(UPLOAD_DIR + path.sep)) {
       throw new Error("Path traversal attempt");
     }
   
     return await fs.readFile(requested);
   }
   
   // Python equivalent:
   // import os
   // resolved = os.path.realpath(os.path.join(UPLOAD_DIR, user_filename))
   // if not resolved.startswith(UPLOAD_DIR + os.sep):
   //     raise ValueError("Path traversal")

3. 3

   Reject suspicious filename characters before path operations

   Even with canonicalization, reject filenames with `..`, leading `/`, leading `\`, null bytes, or control characters. Belt-and-suspenders defense.

   Allow-list characters rather than block-list: `[A-Za-z0-9._-]+` covers most legitimate filenames. If you need Unicode support (international users), be careful — `\u202E` (right-to-left override) and other Unicode tricks can disguise extensions.

   pythonStep 3

   import re
   import os
   
   SAFE_FILENAME = re.compile(r'^[A-Za-z0-9._-]+$')
   
   def safe_open(base_dir: str, filename: str):
       # Reject obvious bad input early
       if not SAFE_FILENAME.match(filename):
           raise ValueError(f"Invalid filename: {filename}")
       if filename.startswith(".") or filename.endswith("."):
           raise ValueError(f"Invalid filename: {filename}")
   
       # Canonicalize and verify
       base = os.path.realpath(base_dir)
       resolved = os.path.realpath(os.path.join(base, filename))
       if not resolved.startswith(base + os.sep):
           raise ValueError(f"Path traversal: {filename}")
   
       return open(resolved, "rb")

4. 4

   Run the file-serving process with minimal filesystem access

   Defense-in-depth: even if traversal happens, the process can only read what the OS lets it. Use Linux capabilities, AppArmor/SELinux profiles, or run inside a container with read-only root filesystem.

   Don't run web servers as root. Use a dedicated user (`www-data`, `nobody`) with read access only to the directories it needs. In containers, mount only required paths. For sensitive ops (user uploads), consider chroot or systemd's `ProtectSystem=strict` + `ReadWritePaths=`.

   yamlStep 4

   # Docker — read-only root + writable upload volume
   services:
     api:
       image: my-app
       read_only: true
       tmpfs:
         - /tmp
       volumes:
         - uploads:/var/uploads:rw      # writable for legit uploads
         - /etc/myapp:/etc/myapp:ro     # config readable
       user: "1000:1000"                # non-root
       cap_drop: [ALL]
       security_opt:
         - no-new-privileges:true
   
   # systemd unit equivalent:
   # ProtectSystem=strict
   # ProtectHome=true
   # ReadWritePaths=/var/uploads

5. 5

   Don't reflect the filename in error messages

   When path validation fails, return a generic error. Reflecting the requested path tells attackers exactly what filter you're using, helping them craft bypasses.

   `Error: cannot read /etc/passwd` confirms the traversal got through canonicalization but failed the prefix check. `Error: invalid file` reveals nothing. Log the details server-side; show users only the generic message.

   goStep 5

   // ❌ Leaks the resolved path
   http.Error(w, fmt.Sprintf("Cannot read %s", resolved), http.StatusBadRequest)
   
   // ✅ Generic to user, full detail in logs
   log.Printf("path traversal attempt: user=%s requested=%q resolved=%q",
       userID, userFilename, resolved)
   http.Error(w, "Invalid filename", http.StatusBadRequest)