Avoid allowing access to unintended directories or files
このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、
お気軽にご連絡ください。
ID: javascript-express/path-traversal
Language: JavaScript
Severity: Warning
Category: Security
CWE: 22
Description
By not sanitizing user input prior to using it in path resolution methods you open your application’s access to unintended directories and files.
If you’re using replace
on a user input, this rule will assume you’ve done so correctly and will not report a violation
Learn More
Non-Compliant Code Examples
const path = require("path");
app.get("/", (req, res) => {
path.join("/user/", req.params.path)
var pathname = path.join("/public/", req.body.foo)
path.resolve(pathname)
path.resolve(__dirname, req.body.foo)
path.resolve(__dirname, `${req.body.foo}`)
})
Compliant Code Examples
const path = require("path");
app.get("/", (req, res) => {
path.join("/user/", req.params.path.replace(/^(\.\.(\/|\\|$))+/, ''))
var pathname = path.join("/public/", req.body.foo.replace(/^(\.\.(\/|\\|$))+/, ''))
path.resolve(pathname)
path.resolve(__dirname, req.body.foo.replace(/^(\.\.(\/|\\|$))+/, ''))
path.resolve(__dirname, `${req.body.foo.replace(/^(\.\.(\/|\\|$))+/, '')}`)
})
Seamless integrations. Try Datadog Code Analysis