Zennoxa Shield
Rules / Dart
SHIELD-DART-010

Path traversal via unsanitized file path

highDartCWE-22CVSS 7.5

What it detects

Building a File from request-derived input allows reading or writing files outside the intended directory.

How to fix

Canonicalize the path and verify it stays within an allowed base directory.

Vulnerable — Shield flags thisupload_reader.dart
import 'dart:io';

Future<String> readUpload(HttpRequest request) {
  return File('uploads/${request.uri.queryParameters['file']}').readAsString();
}
Fixed — scans cleanupload_reader.dart
import 'dart:io';
import 'package:path/path.dart' as p;

Future<String> readUpload(HttpRequest request, String baseDir) {
  final name = p.basename(request.uri.queryParameters['file'] ?? '');
  final full = p.normalize(p.join(baseDir, name));
  if (!p.isWithin(baseDir, full)) throw ArgumentError('invalid path');
  return File(full).readAsString();
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-DART-010, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-DART-010: Path traversal via unsanitized file path — Zennoxa Shield