> For the complete documentation index, see [llms.txt](https://docs.sec1.io/user-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sec1.io/user-docs/4-sast/3-javascript/unsanitized-user-input-in-file-path-traversal.md).

# Unsanitized User Input in File Path Traversal

## Overview

* **Rule ID**: `javascript_express_path_traversal`
* **Applicable Languages**: Javascript
* **Weakness ID**: CWE-73

## Description

Using unsanitized user input to construct file paths can allow attackers to access files and directories beyond the intended limits. This vulnerability, known as path traversal, poses a significant security risk.

## Remediation Guidelines

* **Do not** directly use user input in file path construction. This can lead to unauthorized file access.
* **Do** sanitize user input before using it in path resolution. Replace or remove dangerous patterns like `..\..` to prevent directory traversal attacks.

  ```javascript
  var sanitizedPath = userInput.replace(/^(\.\.(\/|\\|$))+/, '');

  ```
* **Do check** for and eliminate any instances of the poison NULL byte (%00) in user input, as it can be used to bypass path sanitization.

  ```javascript
  if (userInput.indexOf('\0') !== -1) {
    // Handle or reject the input
  }

  ```
* **Do validate** the final path to ensure it is within the intended scope before accessing the file system.

## References

* [**OWASP Path Traversal**](https://owasp.org/www-community/attacks/Path_Traversal)
* [**CWE-73: External Control of File Name or Path**](https://cwe.mitre.org/data/definitions/73.html)
* [**OWASP Top 10: A04:2021 - Insecure Design**](https://owasp.org/Top10/A04_2021-Insecure_Design/)

## Configuration

To omit this rule during a scan, and to provide you with continuous 24/7 code-level scanning, you can employ our [**SAST TOOL**](https://scopy.sec1.io/login)