/path-traversal

name: path-traversal
description: "Detect path traversal and Zip Slip vulnerabilities where user-controlled path components can escape intended directories."
metadata:
  filePattern:
    - "**/*.js"
    - "**/*.ts"
    - "**/*.py"
    - "**/*.go"
  bashPattern:
    - "semgrep.*path"
    - "grep.*(path\\.join|writeFile|extractall)"
  priority: 90

Path Traversal & Zip Slip Detection

When to Use

Audit archive extraction libraries, file upload handlers, static file servers, file path utilities, and any package that writes files based on user-controlled names.

~85% CVE acceptance rate when confirmed.

Key Insight

`path.join()` does NOT prevent `..` traversal in Node.js:

path.join('/uploads', '../../../etc/passwd')
// Returns: '/etc/passwd' -- NOT '/uploads/etc/passwd'

`path.resolve()` returns an absolute path but also does NOT validate that it stays within a base directory.

Variants

1. Classic Path Traversal

User controls a filename/path parameter that is concatenated with a base directory:

const filePath = path.join(uploadDir, req.params.filename);
fs.readFileSync(filePath); // ../../../etc/passwd

2. Zip Slip

Malicious archive entries contain `../` in their filenames. During extraction, files are written outside the intended directory:

malicious.zip contains:
  ../../../../tmp/pwned.txt

3. Symlink Following

Archive contains a symlink pointing outside the target directory, then a file targeting that symlink. During extraction, the file follows the symlink and writes to an arbitrary location.

4. Backslash Bypass

On Windows or with naive path checks, `..\` bypasses `../` filtering:

filename = "..\\..\\..\\etc\\passwd"

5. URL Encoding Bypass

%2e%2e%2f = ../
%2e%2e/ = ../
..%2f = ../
Double encoding: %252e%252e%252f

6. Null Byte (Legacy)

../../etc/passwd%00.png

Older systems truncate at null byte. Rare in modern runtimes.

Process

Step 1: Find File Operations

# JavaScript/TypeScript
grep -rn "fs\.writeFile\|fs\.createWriteStream\|fs\.rename\|fs\.copyFile" .
grep -rn "fs\.readFile\|fs\.readFileSync\|fs\.createReadStream" .
grep -rn "path\.join\|path\.resolve" .

# Python
grep -rn "open(.*w\|shutil\.copy\|shutil\.move\|os\.rename" .
grep -rn "extractall\|extract(" .

# Go
grep -rn "os\.Create\|os\.OpenFile\|io\.Copy\|filepath\.Join" .
grep -rn "archive/zip\|archive/tar" .

Step 2: Check Archive Extraction

grep -rn "unzip\|extract\|decompress\|gunzip\|untar" .
grep -rn "adm-zip\|yauzl\|unzipper\|archiver\|tar\|fflate\|JSZip\|node-7z" .
grep -rn "zipfile\|tarfile\|py7zr\|patool" .

Step 3: Check Path Validation

grep -rn "startsWith\|indexOf\|includes\|realpath\|normalize" .
grep -rn "\.\." . --include="*.js" | grep -i "reject\|deny\|block\|filter"

Step 4: Verify Validation Effectiveness

Common INCORRECT validations:

• `path.join(base, input)` -- does NOT prevent traversal
• `input.indexOf('..') === -1` -- can be bypassed with `....//` or encoding
• `input.replace('../', '')` -- bypassed with `....//` (after removal, `../` remains)

CORRECT validations:

• `path.resolve(base, input)` then `result.startsWith(base + path.sep)` -- verifies result is within base
• `fs.realpathSync()` to resolve symlinks before checking

CVSS Guidance

• Arbitrary file read (unauthenticated): HIGH 7.5
• Arbitrary file write via Zip Slip: HIGH 7.5-8.1
• File write + code execution (overwrite config/executable): CRITICAL 9.8
• Authenticated file read: MEDIUM 6.5

References

• [Sinks](references/sinks.md) -- File operation sinks by language
• [False Positive Indicators](references/false-positive-indicators.md) -- When this isn't exploitable
• [PoC Skeleton](references/poc-skeleton.md) -- Path traversal and Zip Slip PoC templates