Zennoxa Shield
Rules / JavaScript / TypeScript
SHIELD-JS-008

Path traversal via user input

highJavaScript / TypeScriptCWE-22CVSS 7.5

What it detects

Constructing file paths from user input without sanitization allows directory traversal.

How to fix

Validate and sanitize file paths. Use path.resolve() and check against an allowed base directory.

Vulnerable — Shield flags thisdownload.js
const fs = require("fs");
const express = require("express");
const app = express();

app.get("/download", (req, res) => {
  // ?file=../../etc/passwd escapes the uploads directory
  const data = fs.readFileSync("./uploads/" + req.query.file);
  res.send(data);
});
Fixed — scans cleandownload.js
const path = require("path");
const express = require("express");
const app = express();

// Serve only whitelisted files; user input selects a key, never a path
app.get("/download", (req, res) => {
  let file;
  switch (req.query.file) {
    case "invoice": file = "/srv/uploads/invoice.pdf"; break;
    case "receipt": file = "/srv/uploads/receipt.pdf"; break;
    default: return res.status(404).end();
  }
  res.sendFile(file);
});

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-JS-008, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-JS-008: Path traversal via user input — Zennoxa Shield