fabioc-aloha/alex_skill_mall/path-traversal-prevention

// Vulnerable: attacker controls filename
const dest = path.join(uploadDir, req.body.filename);
// If filename is "../../../etc/passwd", dest escapes uploadDir

function safeJoin(root, userPath) {
  const resolved = path.resolve(root, userPath);
  const normalized = path.normalize(resolved);
  
  // Ensure result is still within root
  if (!normalized.startsWith(path.normalize(root) + path.sep) && 
      normalized !== path.normalize(root)) {
    throw new Error('Path traversal attempt detected');
  }
  
  return normalized;
}
// Usage
try {
  const safePath = safeJoin('/uploads', userFilename);
  // Safe to use safePath
} catch (err) {
  res.status(400).json({ error: 'Invalid filename' });
}

async function safeCopyTree(src, dest, allowedRoot) {
  const entries = await fs.readdir(src, { withFileTypes: true });
  
  for (const entry of entries) {
    const srcPath = path.join(src, entry.name);
    const destPath = path.join(dest, entry.name);
    
    // Validate destination stays in bounds
    const resolvedDest = path.resolve(destPath);
    if (!resolvedDest.startsWith(path.resolve(allowedRoot))) {
      throw new Error(`Path escape: ${entry.name}`);
    }
    
    if (entry.isDirectory()) {
      await fs.mkdir(destPath, { recursive: true });
      await safeCopyTree(srcPath, destPath, allowedRoot);
    } else {
      await fs.copyFile(srcPath, destPath);
    }
  }
}

const attacks = [
  '../etc/passwd',
  '..\\windows\\system32',
  'foo/../../bar',
  'normal/path/file.txt'  // Should pass
];
attacks.forEach(p => {
  try {
    const result = safeJoin('/uploads', p);
    console.log(`OK: ${p} -> ${result}`);
  } catch (e) {
    console.log(`BLOCKED: ${p}`);
  }
});