createWriteStream vulnerable to path traversal?

[Broham]

It looks like it is possible to navigate back directories when using createWriteStream. For example:

createWriteStream("/var/site/tmp/../../myfile.txt) 

Will write to /var/myfile.txt

Is there a way to prevent path traversal when using createWriteStream?

[pipobscure]

Check out http://nodejs.org/api/path.html

You can normalize your Path and then find the relative path and then check for .. in the path.

You probably want to ask this kind of question on https://groups.google.com/forum/#!forum/nodejs though.

(Or ask on IRC freenode#nodejs)

[tjfontaine]

What @PhiDelta said, it is your responsibility to be defensive and these sorts of questions are meant for other support mechanisms

[isaacs]

For posterity, when I want to restrict a path to something within a given root dir, I usually do something like this:

var safePath = path.join(safeRoot, path.join('/', unsafePath));

That can potentially have odd effects on Windows, which uses wrong slashes and has crazy drive and UNC logics.

Another way to do it (which is more portable) is something like this:

unsafePath = path.resolve(unsafePath);
if (unsafePath.indexOf(safeRoot) !== 0) {
  throw new Error('traversal shenanigans detected!');
}