Path traversal (ARCH6103)

Key ruby.security.path-traversal · Severity error · Category security · CWE CWE-22

Building a file path from untrusted input without normalization and containment lets attackers escape the intended directory (../) and reach arbitrary files.

Incorrect

def read(name)
  File.read(File.join("/var/data", name))
end

Correct

def read(name)
  base = File.expand_path("/var/data")
  path = File.expand_path(File.join(base, name))
  raise "invalid path" unless path.start_with?("#{base}/")
  File.read(path)
end

Fix

Resolve and normalize the path, then verify the result stays inside the allowed root directory.