[Security] Fix CodeQL alert #29: Uncontrolled data used in path expression

[colin-d-fried]

Summary

Fixes CodeQL alert #29: Uncontrolled data used in path expression

Field	Value
Severity	high
File	vulnerable_path_traversal.py
CWE	CWE-022
Alert	CodeQL Alert #29

Fix Applied

See the diff for the specific secure coding change applied.

Fixes #31

---

---

Note

Medium Risk
Adds path canonicalization and base-directory enforcement for user-supplied filenames; low code churn but touches file-system access where mistakes could still allow bypasses or block legitimate files.

Overview
Hardens the /read endpoint in vulnerable_path_traversal.py by resolving the requested filename against a fixed base directory and denying requests whose real path escapes that directory.

This replaces direct open(file_name) with realpath-based validation and reads from the validated safe_path, returning 403 on traversal attempts.

^{Written by Cursor Bugbot for commit 935aa5d. This will update automatically on new commits. Configure here.}

[devin-ai-integration]

Devin Review found 1 potential issue.

View 1 additional finding in Devin Review.

[devin-ai-integration]

🔴 Path traversal bypass via startswith check without trailing separator

os.path.realpath('/var/www/files/') strips the trailing slash, so base_dir is /var/www/files. The check safe_path.startswith(base_dir) can be bypassed by accessing sibling directories whose names share the same prefix (e.g., /var/www/files_secret/). For example, filename=../files_secret/passwd resolves to /var/www/files_secret/passwd, which passes the startswith('/var/www/files') check, allowing reads outside the intended directory.

Example bypass

GET /read?filename=../files_secret/sensitive.txt

• base_dir = /var/www/files
• safe_path = os.path.realpath('/var/www/files/../files_secret/sensitive.txt') = /var/www/files_secret/sensitive.txt
• '/var/www/files_secret/sensitive.txt'.startswith('/var/www/files') → True → access granted

Suggested change

	if not safe_path.startswith(base_dir):
	if not safe_path.startswith(base_dir + os.sep):

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[cursor]

Path traversal fix bypassable via sibling directory prefix

High Severity

os.path.realpath strips the trailing slash from '/var/www/files/', so base_dir becomes '/var/www/files'. The startswith check then incorrectly permits access to sibling directories with a common prefix (e.g., /var/www/files_secret/), because '/var/www/files_secret/foo'.startswith('/var/www/files') is True. The check needs to compare against base_dir + os.sep to ensure the resolved path is actually within the intended directory.