Directory Traversal

// Node.js/Express - Secure file access with path validation

// SECURE: Log viewer with strict validation
app.get('/logs', (req, res) => {
  const filename = req.query.file || '';
  const BASE = '/var/app/logs';
  
  // 1. Validate filename format - only simple filenames, no path separators
  if (!/^[a-zA-Z0-9_.-]{1,64}$/.test(filename)) {
    return res.status(400).json({ error: 'Invalid filename format' });
  }
  
  // 2. Resolve to canonical absolute path
  const absBase = path.resolve(BASE);
  const targetPath = path.resolve(absBase, filename);
  
  // 3. Verify the resolved path is still within base directory
  // This catches ../ traversal and symlink attacks
  if (!targetPath.startsWith(absBase + path.sep)) {
    return res.status(403).json({ error: 'Access denied' });
  }
  
  // 4. Check file exists and is readable
  fs.access(targetPath, fs.constants.R_OK, (err) => {
    if (err) {
      return res.status(404).json({ error: 'File not found' });
    }
    
    fs.readFile(targetPath, 'utf8', (err, data) => {
      if (err) {
        return res.status(500).json({ error: 'Read error' });
      }
      res.type('text/plain').send(data);
    });
  });
});

// SECURE: Use ID mapping instead of file paths
const ALLOWED_IMAGES = {
  'logo': 'company-logo.png',
  'banner': 'hero-banner.jpg',
  'avatar': 'default-avatar.png'
};

app.get('/images', (req, res) => {
  const imageId = req.query.id;
  const IMAGE_DIR = '/var/app/public/images';
  
  // Map ID to filename - user never controls the path
  const filename = ALLOWED_IMAGES[imageId];
  
  if (!filename) {
    return res.status(404).json({ error: 'Image not found' });
  }
  
  // Safe: filename comes from our mapping, not user input
  const imagePath = path.join(IMAGE_DIR, filename);
  res.sendFile(imagePath);
});

// SECURE: Download with whitelist validation
const ALLOWED_DOCUMENTS = new Set([
  'user-guide.pdf',
  'terms.pdf',
  'privacy-policy.pdf',
  'api-docs.pdf'
]);

app.get('/download', (req, res) => {
  const documentName = req.query.doc;
  const DOCS_BASE = '/var/app/documents';
  
  // Whitelist check - only allow specific documents
  if (!ALLOWED_DOCUMENTS.has(documentName)) {
    return res.status(403).json({ error: 'Document not available' });
  }
  
  // Additional validation: no path separators
  if (documentName.includes('/') || documentName.includes('\\')) {
    return res.status(400).json({ error: 'Invalid document name' });
  }
  
  const fullPath = path.join(DOCS_BASE, documentName);
  const canonicalPath = path.resolve(fullPath);
  const canonicalBase = path.resolve(DOCS_BASE);
  
  // Double-check containment
  if (!canonicalPath.startsWith(canonicalBase + path.sep)) {
    return res.status(403).json({ error: 'Access denied' });
  }
  
  res.download(canonicalPath);
});

// SECURE: Template system with fixed templates only
const ALLOWED_PAGES = {
  'home': 'home.html',
  'about': 'about.html',
  'contact': 'contact.html',
  'pricing': 'pricing.html'
};

app.get('/page', (req, res) => {
  const pageId = req.query.id || 'home';
  const TEMPLATES_DIR = '/var/app/views';
  
  // Map page ID to template filename
  const templateFile = ALLOWED_PAGES[pageId];
  
  if (!templateFile) {
    return res.status(404).send('Page not found');
  }
  
  // Safe: template path comes from our whitelist
  const templatePath = path.join(TEMPLATES_DIR, templateFile);
  
  fs.readFile(templatePath, 'utf8', (err, content) => {
    if (err) {
      return res.status(500).send('Error loading page');
    }
    res.send(content);
  });
});