Path traversal (ARCH3103)

Key typescript.security.path-traversal · Severity error · Category security · CWE CWE-22

Building a file path from user input without validation lets ../ sequences reach files outside the intended directory, such as /etc/passwd.

Incorrect

import { readFile } from "fs/promises";
import path from "path";

app.get("/files", async (req, res) => {
  // name="../../etc/passwd"
  const data = await readFile(path.join("/data", req.query.name as string));
  res.send(data);
});

Correct

import { readFile } from "fs/promises";
import path from "path";

const ROOT = "/data";
app.get("/files", async (req, res) => {
  const full = path.resolve(ROOT, req.query.name as string);
  if (!full.startsWith(ROOT + path.sep)) return res.status(400).end();
  res.send(await readFile(full));
});

Fix

Normalize the path with path.resolve and confirm the result stays inside the intended root directory.