• Home
  • Features
  • Pricing
  • Docs
  • Announcements
  • Sign In

richardgirges / express-fileupload / 46282c63-b555-4d06-9e41-36ccf1fc817f
93%
master: 95%

Build:
Build:
LAST BUILD BRANCH: security-path-validation
DEFAULT BRANCH: master
Ran 19 Dec 2025 08:54AM UTC
Jobs 1
Files 9
Run time 396min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

19 Dec 2025 08:49AM UTC coverage: 92.969% (-1.6%) from 94.524%
46282c63-b555-4d06-9e41-36ccf1fc817f

Pull #390

circleci

h15629526027
Add optional path validation to prevent path traversal attacks

This change adds opt-in path validation to protect against path traversal
vulnerabilities when user input is passed to the mv() function.

## Changes:

### New Configuration Options:
- uploadDir: Base directory for uploads (null = validation disabled)
- validatePaths: Enable/disable validation (default: true)
- allowAbsolutePaths: Allow absolute paths (default: false)

### Security Features:
- Validates paths to prevent directory traversal (../)
- Blocks URL encoded attacks (%2e%2e%2f)
- Blocks double URL encoding (%252e%252e)
- Blocks null byte injection (%00)
- Blocks Windows-style traversal (..\)
- Prevents paths from escaping uploadDir
- Validates path length (max 1024 chars)

### Implementation:
- Added validateUploadPath() function in lib/utilities.js
- Integrated validation in lib/fileFactory.js mv() method
- Added comprehensive test suite (15+ test cases)
- Updated README with security best practices

## Backward Compatibility:
- NON-BREAKING: Validation only active when uploadDir is set
- Existing code without uploadDir works exactly as before
- No changes required for current users

## Testing:
- All existing tests pass
- New tests cover path traversal prevention
- Tested with real application (legacy and secure modes)
- Attack vectors successfully blocked

Addresses security concerns around path traversal when developers
pass user-controlled input to file.mv() without validation.
Pull Request #390: Add optional path validation to prevent path traversal attacks

185 of 205 branches covered (90.24%)

30 of 38 new or added lines in 2 files covered. (78.95%)

357 of 384 relevant lines covered (92.97%)

744.52 hits per line

New Missed Lines in Diff

Lines Coverage ∆ File
4
77.78
-22.22% lib/fileFactory.js
4
97.52
-2.48% lib/utilities.js
Jobs
ID Job ID Ran Files Coverage
1 46282c63-b555-4d06-9e41-36ccf1fc817f.1 19 Dec 2025 08:54AM UTC 9
92.97
Source Files on build 46282c63-b555-4d06-9e41-36ccf1fc817f
  • Tree
  • List 9
  • Changed 3
  • Source Changed 0
  • Coverage Changed 3
Coverage ∆ File Lines Relevant Covered Missed Hits/Line Branch Hits Branch Misses
  • Back to Repo
  • CircleCI Build #46282C63...
  • Pull Request #390
  • PR Base - master (#1F440444...)
STATUS · Troubleshooting · Open an Issue · Sales · Support · CAREERS · ENTERPRISE · START FREE · SCHEDULE DEMO
ANNOUNCEMENTS · TWITTER · TOS & SLA · Supported CI Services · What's a CI service? · Automated Testing

© 2026 Coveralls, Inc