path-traversal

base_path = Rails.root.join('storage', 'exports').realpath
requested = base_path.join(params[:filename].to_s).cleanpath

unless requested.to_s.start_with?(base_path.to_s) && requested.file?
  raise ActionController::RoutingError, 'Not Found'
end

Preventing path traversal in download endpoints

path-traversal file-security secure-coding

by Kai Nakamura 1 tab

rust

use std::path::{Component, Path, PathBuf};

#[derive(Debug)]
pub enum ResolveError {
    Traversal,
    NotFound,

Safely Serving Static Files with Path Traversal Protection in Rust

rust axum tokio

by codesnips 3 tabs