Group
  • Security

    Prevent path traversal in file operations

    Stops ../ sequences in filenames and paths from reading or writing files outside the intended directory.

    • Improve quality
    • Debug & fix
    • Intermediate
    • General

Free Prompt

Audit my app for path traversal vulnerabilities. Find every place a user-supplied value (filename, path segment, export name, template name) is joined into a filesystem path for reading or writing. For each one: resolve the final path and verify it stays inside the intended base directory (resolve both and confirm the result starts with the base path, handling symlinks); reject names containing path separators, .., or null bytes up front; where possible, don't use user input in paths at all (map user-facing names to server-generated IDs and store the real path server-side). Cover the encoding bypasses: URL-encoded (%2e%2e%2f) and double-encoded sequences must not slip through. Do not change the file storage layout or rename existing files. Do not rely on string replacement of ".." alone; recursive or encoded variants defeat naive filters, so canonicalization plus a base-directory check is the requirement. List each file operation point and the protection added. Give me test cases: a request for ../../etc/passwd (or the Windows equivalent), an encoded variant, and a legitimate file, with the first two refused.

What This Does / How This Helps

Finds every place user input becomes a filesystem path and makes sure it can't climb out of its directory with ../ tricks. Path traversal turns a download or export feature into a file reader for your whole server: ../../etc/passwd, your .env file, your source code, your database credentials. Any endpoint that takes a filename and reads it from disk without checking where the path lands is a candidate. The prompt insists on canonicalization plus a base-directory check rather than string filtering, because encoded and nested variants sail past simple replaces. Test cases included.

Want to skip doing this by hand?

Fortivibe audits your app for all of the areas these prompts cover (and more).

See What We Check

Related Prompts