Path Traversal (ARCH5103)

Key go.security.path-traversal · Severity error · Category security · CWE CWE-22

Joining a user-supplied filename into a path without validation lets attackers use ../ sequences to read files outside the intended directory.

Incorrect

func serve(w http.ResponseWriter, r *http.Request) {
  name := r.URL.Query().Get("file")
  data, err := os.ReadFile(filepath.Join("/srv/files", name))
  if err != nil {
    http.Error(w, "not found", 404)
    return
  }
  w.Write(data)
}

Correct

func serve(w http.ResponseWriter, r *http.Request) {
  name := r.URL.Query().Get("file")
  clean := filepath.Join("/srv/files", filepath.Clean("/"+name))
  if !strings.HasPrefix(clean, "/srv/files/") {
    http.Error(w, "forbidden", 403)
    return
  }
  data, err := os.ReadFile(clean)
  if err != nil {
    http.Error(w, "not found", 404)
    return
  }
  w.Write(data)
}

Fix

Normalize the path with filepath.Clean and verify the result stays within the intended root directory.