Path traversal prevention

Path traversal (CWE-22, OWASP A01 Broken Access Control) uses ../ sequences to escape an intended directory, allowing an attacker to read files like /etc/passwd, process.env, or private keys from arbitrary locations on the filesystem. NIST 800-53 SI-10 requires input sanitization before filesystem operations. Any endpoint that accepts a filename parameter — downloads, file preview, static serving — is a potential traversal vector if the path is not normalized and boundary-checked. A URL like /api/download?file=../../.env against a naive path.join implementation returns the application's secrets.

Normalize every user-supplied path with path.resolve() and verify it starts with the expected base directory:

import path from 'path'

const UPLOADS_DIR = path.resolve(process.cwd(), 'uploads')

function safeReadFile(userFilename: string): Buffer {
  const resolved = path.resolve(UPLOADS_DIR, userFilename)

  if (!resolved.startsWith(UPLOADS_DIR + path.sep)) {
    throw new Error('Access denied')
  }

  return require('fs').readFileSync(resolved)
}

Store uploaded files with random UUIDs as names (crypto.randomUUID()) rather than user-supplied filenames to eliminate traversal entirely. Serve files from external blob storage (Vercel Blob, S3) where path traversal is not applicable.