Keep file paths inside their folder

How to do it

Prefer IDs that map to files on the server. If you must use a name, resolve the full path and check that it starts with the allowed folder. Reject names with .., slashes or null bytes.

Examples

Plain text example

/download?file=../../etc/hostname
/download?file=..%2f..%2fetc%2fhostname
/download?file=....//....//etc/hostname

JavaScript example

const full = path.resolve(UPLOADS, name);
if (!full.startsWith(UPLOADS + path.sep)) return res.status(404).end();

Python example

# Python 3.9 or later
full = (UPLOADS / name).resolve()
if not full.is_relative_to(UPLOADS.resolve()):
    abort(404)

Go example

// Go 1.24 or later: an os.Root refuses paths that leave the folder
root, err := os.OpenRoot(uploads)
if err != nil { return err }
file, err := root.Open(name)

How to check

The agent asks for files outside the folder, in plain and encoded forms. Every request fails.

Sources

• OWASP Path Traversal attack

Related rules

• MED-40 Store files under keys you make and clean the names you show in Files and media
• APS-45 Unpack archives safely in Application security