Directory Traversal

What Is Directory Traversal?

A handler joins a filename from the request onto a fixed directory and reads whatever that resolves to. Add a few ../ segments and the result sits outside the folder the developer had in mind. You'll swap an invoice name for ../../../etc/passwd on a billing endpoint and get the system account file back. Then you fix it: resolve to canonical form with path.resolve and confirm the result is still inside the intended folder before reading a byte. Stripping .. from the string is not the same check.

What You'll Learn in Directory Traversal

• Recognise directory traversal as the result of joining user input onto a filesystem path without canonicalisation or containment checks
• Read a handler and identify the unsafe path-concatenation pattern
• Understand why a string filter that rejects .. loses to encoded segments and absolute paths
• Apply the canonicalise-then-verify fix: resolve the path and confirm it stays inside the intended directory before reading
• Audit every file read or write whose path is built from request data

Directory Traversal — Training Steps

1. Find the download feature

   Halvora is a billing platform, and every customer can download their own invoices from a self-service page. Bob has an ordinary Halvora account. He opens the invoice download feature to see how it behaves before he touches it.

2. Download a normal invoice

   First, watch the feature behave normally. Bob downloads one of his own invoices. The file lands in his downloads, and the browser's Network panel records the request the page sent, exactly what a developer sees in DevTools.

3. The filename is just a parameter

   The invoice came back. One detail in the request tells Bob how to attack it.

4. Tamper the request and resend

   Bob never needed the download button. He edits the captured request directly, swapping the invoice name for a path that climbs out of wherever the invoices are stored. Each ../ steps up one directory; enough of them reach the filesystem root, and from there etc/passwd is the account file every Linux box has.

5. The file comes back

   The response is not an invoice. It is the server's account file, read off disk and handed back through the same download the feature offers every customer.

6. Knowledge check

   You just watched a tampered download request return the server's account file. Lock in why.

7. The breach alert

   You own Halvora's invoice download service. Overnight, data-loss monitoring flagged the endpoint returning the contents of a server file in place of a PDF. Security operations has emailed you the details.

8. Open the download handler

   Open the download handler and look at how it turns the filename into a file on disk.

9. Spot the flaw

   The filename is concatenated onto the invoice directory and read directly. Nothing constrains the path, so a value with ../ segments reaches outside the folder.

10. Knowledge check

    Before you touch the handler, be clear about why the quick patch is not the fix.