Injection and output
Keep file paths inside a root
Generate storage names, resolve canonical paths, and prevent user-controlled traversal outside the directory an operation owns.
8 minute lesson
A filename like ../../secrets.env is data to the user and a path instruction to the filesystem. Do not treat both meanings as equivalent.
Generate internal storage identifiers and keep the original display name as metadata. When users select known files, map an ID to a server-owned path. If path input is unavoidable, resolve it and verify the result remains inside the allowed root.
A download route joins /srv/reports with ../../.env. A prefix check on the unresolved text passes in one implementation, while a symlink inside the directory escapes later.
Normalizing dot segments does not solve symlink behavior by itself. Server-generated IDs avoid most path interpretation and make the remaining checks smaller.
Test the file route with dot segments, absolute paths, encoded separators, and a symlink that points outside the root. Record the resolved target and prove every escape attempt is denied without revealing the external file.
Lesson completed