[ Amplify ] CWE-22 Fix routes/dataErasure.ts:69

[amplify-lab]

This Pull Request fixes CWE-22, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), in routes/dataErasure.ts:69.

💡 This is an automated Pull Request created by Amplify to fix vulnerability 8f6f91ee.
➡️ For more information, visit Amplify Security.

[amplify-lab]

🔍 Amplify code check status:  

⚠️ 2 issues detected in   📄 1 file and   ❇️ 3 lines of code   🛠️ using Semgrep

Vulnerabilities detected

Click on a CWE to view vulnerability in Amplify

Vulnerability	Path	Fingerprint	Tool
CWE-22	routes/dataErasure.ts:70	[592ba575...]	Semgrep
CWE-22	routes/dataErasure.ts:70	[f98f94ec...]	Semgrep

💡 To ignore a finding, append @amplify-ignore in a comment to the end of the vulnerable link like // @amplify-ignore or # @amplify-ignore. For more details, visit the Amplify Security Documentation.

Last updated by commit 0d0ccdc at 2024-12-12 15:02:26 UTC.

[amplify-lab]

⚠️ Vulnerability: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

🚨 Impact: MEDIUM

📰 The Gist: Detected possible user input going into a path.join or path.resolve function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.

Suggested code

--- routes/dataErasure.ts
+++ routes/dataErasure.ts
@@ -69,7 +69,8 @@
       const sanitizedLayout: string = path.basename(req.body.layout)
       const filePath: string = path.resolve('allowed_directory', sanitizedLayout).toLowerCase()
       const isForbiddenFile: boolean = (filePath.includes('ftp') || filePath.includes('ctf.key') || filePath.includes('encryptionkeys'))
-      if (!isForbiddenFile) {
+      const isValidPath: boolean = filePath.startsWith(path.resolve('allowed_directory') + path.sep)
+      if (!isForbiddenFile && isValidPath) {
         res.render('dataErasureResult', {
           ...req.body
         }, (error, html) => {

[amplify-lab]

⚠️ Vulnerability: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

🚨 Impact: MEDIUM

📰 The Gist: Possible writing outside of the destination, make sure that the target path is nested in the intended destination

Suggested code

--- routes/dataErasure.ts
+++ routes/dataErasure.ts
@@ -69,7 +69,8 @@
       const sanitizedLayout: string = path.basename(req.body.layout)
       const filePath: string = path.resolve('allowed_directory', sanitizedLayout).toLowerCase()
       const isForbiddenFile: boolean = (filePath.includes('ftp') || filePath.includes('ctf.key') || filePath.includes('encryptionkeys'))
-      if (!isForbiddenFile) {
+      const isOutsideAllowedDirectory: boolean = !filePath.startsWith(path.resolve('allowed_directory').toLowerCase())
+      if (!isForbiddenFile && !isOutsideAllowedDirectory) {
         res.render('dataErasureResult', {
           ...req.body
         }, (error, html) => {