richardgirges / express-fileupload
93%
master: 95%

LAST BUILD BRANCH: security-path-validation
DEFAULT BRANCH: master
Repo Added
Files 9
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH security-path-validation
branch: security-path-validation
CHANGE BRANCH
x

coverage: 92.969% (-1.6%) from 94.524%
57eada64-12e3-4809-a474-ee1ff0a655d3

Pull #390

circleci

Theodoros Malachias 
Add optional path validation to prevent path traversal attacks

This change adds opt-in path validation to protect against path traversal
vulnerabilities when user input is passed to the mv() function.

## Changes:

### New Configuration Options:
- uploadDir: Base directory for uploads (null = validation disabled)
- validatePaths: Enable/disable validation (default: true)
- allowAbsolutePaths: Allow absolute paths (default: false)

### Security Features:
- Validates paths to prevent directory traversal (../)
- Blocks URL encoded attacks (%2e%2e%2f)
- Blocks double URL encoding (%252e%252e)
- Blocks null byte injection (%00)
- Blocks Windows-style traversal (..\)
- Prevents paths from escaping uploadDir
- Validates path length (max 1024 chars)

### Implementation:
- Added validateUploadPath() function in lib/utilities.js
- Integrated validation in lib/fileFactory.js mv() method
- Added comprehensive test suite (15+ test cases)
- Updated README with security best practices

## Backward Compatibility:
- NON-BREAKING: Validation only active when uploadDir is set
- Existing code without uploadDir works exactly as before
- No changes required for current users

## Testing:
- All existing tests pass
- New tests cover path traversal prevention
- Tested with real application (legacy and secure modes)
- Attack vectors successfully blocked

Addresses security concerns around path traversal when developers
pass user-controlled input to file.mv() without validation.
Pull Request #390: Add optional path validation to prevent path traversal attacks

185 of 205 branches covered (90.24%)

30 of 38 new or added lines in 2 files covered. (78.95%)

357 of 384 relevant lines covered (92.97%)

744.42 hits per line

Relevant lines Covered
384 RELEVANT LINES 357 COVERED LINES
744.42 HITS PER LINE
Source Files on security-path-validation

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
57eada64... security-path-validation Add optional path validation to prevent path traversal attacks This change adds opt-in path validation to protect against path traversal vulnerabilities when user input is passed to the mv() function. ## Changes: ### New Configuration Options: ... Pull #390 Theodoros Malachias circleci
92.97
46282c63... security-path-validation Add optional path validation to prevent path traversal attacks This change adds opt-in path validation to protect against path traversal vulnerabilities when user input is passed to the mv() function. ## Changes: ### New Configuration Options: ... Pull #390 h15629526027 circleci
92.97
See All Builds (387)