Path Traversal Defense

Path traversal defense

Any time a caller controls part of a path, they are one ../ away from a file you never meant to expose. The failure is subtle because open(base + name) looks confined until name is ../../etc/shadow, and string checks for .. miss URL-encoding, absolute paths, symlinks, and Windows separators. The reliable defense is to resolve the path to its real location and prove it still sits inside the jail.

Method

1. Resolve to a canonical absolute path first. Call os.path.realpath, Java toRealPath, or Node fs.realpath on the joined path. This collapses .., follows symlinks, and normalizes separators, giving you the actual target instead of the string the attacker wrote.
2. Assert the resolved path is inside the base directory. Compare with a prefix check on the canonical base, using a trailing separator so /data/users does not match /data/users-evil. In Python: os.path.commonpath([base, resolved]) == base. Reject anything that fails, do not try to repair it.
3. Canonicalize the base directory once too. Resolve the jail root itself at startup so the comparison is real-path against real-path. A base that still contains a symlink defeats the check you just wrote.
4. Prefer an indirect handle over a raw name. Where you can, map a client id to a server-held path through a lookup table or a UUID, so the user never supplies path text at all. No traversal is possible against a value that is never concatenated into a path.
5. Decode before you validate, once. Percent-decode and Unicode-normalize the input, then check, so %2e%2e%2f and overlong encodings do not slip past a filter that ran on the raw string. Decode exactly once to avoid double-decoding surprises.
6. Validate archive entries on extraction. Zip Slip is traversal by another name: check every entry's resolved destination against the target directory before writing, because an archive can carry ../ in member names.

Checks

• Does a request for ..%2f..%2fetc%2fpasswd resolve, fail the jail check, and return 403 rather than the file?
• Is the containment test a canonical prefix comparison, not a substring search for the literal ..?
• Would a symlink planted inside the jail that points outside it be caught by the real-path resolution?
• Does archive extraction refuse a member whose resolved path leaves the destination directory?

Boundaries

This confines filesystem paths. The same shape of bug in URLs handed to an outbound fetcher is SSRF, and in database identifiers is injection: those have their own skills. Some frameworks and static-file servers already canonicalize and jail; when one does, rely on it and confirm with a traversal probe rather than adding a second inconsistent check.