Web Security · Middle · Question 67 of 75

How do you prevent path traversal in a file download endpoint?

res.sendFile(path.join(UPLOADS, req.query.name));

✓Correct answer: Resolve the final path and check it's still inside UPLOADS, or map IDs to files instead of using names
2Remove the word .. once with replace
3Only allow names that end with .pdf

Explanation

../../etc/passwd and encoded variants escape the folder. Checking the resolved absolute path or avoiding user paths entirely is reliable.

Further reading

OWASP: Path Traversal ↗

Test yourself

Take the Web Security · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.