Path traversal: resolve first, then check containment

Vulnerable

import os

BASE = "/srv/uploads"

def read(name: str) -> bytes:
    # name = "../../etc/passwd" — or "....//....//etc/passwd" after a naive strip
    with open(os.path.join(BASE, name), "rb") as fh:
        return fh.read()

Secure

from pathlib import Path

BASE = Path("/srv/uploads").resolve()

def read(name: str) -> bytes:
    # strict=False so a missing file raises FileNotFoundError below, not here.
    candidate = (BASE / name).resolve()
    if not candidate.is_relative_to(BASE):      # Python 3.9+
        raise PermissionError("outside upload directory")
    if candidate.is_symlink():                  # resolve() already followed it; be explicit
        raise PermissionError("symlinks are not served")
    return candidate.read_bytes()

Vulnerable

app.get("/file", (req, res) => {
  res.sendFile(path.join(UPLOAD_DIR, req.query.name));
});

Secure

const path = require("node:path");
const fs = require("node:fs/promises");

const BASE = path.resolve("/srv/uploads");

app.get("/file", async (req, res) => {
  const raw = String(req.query.name ?? "");
  const candidate = path.resolve(BASE, raw);
  // The separator matters: without it "/srv/uploads-evil" passes the prefix test.
  if (candidate !== BASE && !candidate.startsWith(BASE + path.sep)) {
    return res.status(400).end();
  }
  // realpath resolves symlinks planted inside the base directory.
  const real = await fs.realpath(candidate);
  if (!real.startsWith(BASE + path.sep)) return res.status(400).end();

  res.sendFile(real);
});

Vulnerable

try (ZipInputStream zis = new ZipInputStream(in)) {
  ZipEntry e;
  while ((e = zis.getNextEntry()) != null) {
    File out = new File(destDir, e.getName());   // e.getName() may be "../../bin/app.sh"
    Files.copy(zis, out.toPath());
  }
}

Secure

Path base = destDir.toPath().toRealPath();
try (ZipInputStream zis = new ZipInputStream(in)) {
  ZipEntry e;
  while ((e = zis.getNextEntry()) != null) {
    Path target = base.resolve(e.getName()).normalize();
    if (!target.startsWith(base)) {
      throw new IOException("zip entry escapes destination: " + e.getName());
    }
    if (e.isDirectory()) { Files.createDirectories(target); continue; }
    Files.createDirectories(target.getParent());
    Files.copy(zis, target, StandardCopyOption.REPLACE_EXISTING);
  }
}