Oh look, path traversal meets vibe coding

[brauner@mastodon.social]

RE: https://cyberplace.social/@GossiTheDog/116080909947754833

Oh look, path traversal meets vibe coding.
Everyone should know that path traversal is like the easiest thing to get right. It's famously trivial. Not like we've been plagued by security issues. Imagine if Linux had symlinks or heaven forbid magic links. Oh well.

[dascandy@infosec.exchange]

@brauner what is the colloquially correct way? I have one but would love to hear from others that have done this before.

[brauner@mastodon.social]

@dascandy There's #systemd's chase()/chaseat() [1] and @cyphar 's #libpathrs [2]. Both are pretty good and cover a lot of edge cases.

[1]: https://github.com/systemd/systemd/blob/main/src/basic/chase.c
[2]: https://github.com/cyphar/libpathrs/?tab=readme-ov-file

[dascandy@infosec.exchange]

@cyphar @brauner I tried to first canonicalize the path (resolve symlinks, remove ./ and ../) and then check if the resulting path is still a subpath of the target root. I can see a few ways it differs from these two, but I don't know if those are security issues?