Zennoxa Shield
Rules / Ruby
SHIELD-RUBY-015

Path traversal via File or send_file with params

highRubyCWE-22CVSS 8.1

What it detects

Building a file path from params in File.read, File.open, or send_file enables path traversal.

How to fix

Resolve the path and confirm it stays within an allowed base directory before access.

Vulnerable — Shield flags thisapp/controllers/downloads_controller.rb
class DownloadsController < ApplicationController
  def show
    data = File.read(params[:file])
    send_data data, filename: params[:file]
  end
end
Fixed — scans cleanapp/controllers/downloads_controller.rb
class DownloadsController < ApplicationController
  BASE_DIR = Rails.root.join("public", "downloads")

  def show
    path = BASE_DIR.join(File.basename(params[:file].to_s))
    raise ActionController::RoutingError, "Not Found" unless path.to_s.start_with?(BASE_DIR.to_s)
    send_data File.read(path), filename: path.basename.to_s
  end
end

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-RUBY-015, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-RUBY-015: Path traversal via File or send_file with params — Zennoxa Shield