Path Traversal (ARCH9103)

Key swift.security.path-traversal · Severity error · Category security · CWE CWE-22

Flags file paths built from request or user input. A string template that only splices values the app produced itself is not untrusted, and a parameter named path or url is not evidence of input.

Incorrect

let file = URL(fileURLWithPath: "\(uploadDir)/\(request.name)")

Correct

let file = uploadDir.appendingPathComponent(name).standardizedFileURL
guard file.path.hasPrefix(uploadDir.standardizedFileURL.path) else { throw Forbidden() }

Fix

Standardise the URL and check it stays under the intended directory.