Node.js · Senior · Question 28 of 75
How do you safely serve a user-requested file from an uploads directory?
- 1Allow any path, since
fsblocks access outside the project - 2Remove
../from the name withreplaceonce - ✓Correct answer: Resolve the full path, then check it still starts with the uploads directory before reading
Explanation
Path traversal can use encodings or absolute paths, so a single replace isn't enough. Better still, store files by generated IDs and keep names in the database.