Zennoxa Shield
Rules / Go
SHIELD-GO-006

Path traversal via user-controlled filepath

highGoCWE-22CVSS 7.5

What it detects

Using user input in file paths without sanitization allows directory traversal.

How to fix

Use filepath.Clean() and verify the path is within the allowed base directory.

Vulnerable — Shield flags thisdownload.go
package files

import (
	"net/http"
	"os"
)

func Download(w http.ResponseWriter, r *http.Request) {
	// "../../etc/passwd" escapes the reports directory
	data, err := os.ReadFile("/var/reports/" + r.URL.Query().Get("file"))
	if err != nil {
		http.NotFound(w, r)
		return
	}
	w.Write(data)
}
Fixed — scans cleandownload.go
package files

import (
	"net/http"
	"os"
)

// Allowlist: request keys map to fixed paths inside the base directory,
// so no user-supplied path component ever reaches the filesystem.
var reports = map[string]string{
	"summary": "/var/reports/summary.pdf",
	"audit":   "/var/reports/audit.pdf",
}

func Download(w http.ResponseWriter, r *http.Request) {
	path, ok := reports[r.URL.Query().Get("file")]
	if !ok {
		http.NotFound(w, r)
		return
	}
	data, err := os.ReadFile(path)
	if err != nil {
		http.NotFound(w, r)
		return
	}
	w.Write(data)
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-GO-006, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-GO-006: Path traversal via user-controlled filepath — Zennoxa Shield