1 stable release

2.0.0	Feb 27, 2023
1.0.1	~~Nov 21, 2022~~

#24 in #relative-path

65 downloads per month

Apache-2.0

9KB

Path trav

A simple path traversal checker made with Rust. Useful for APIs that serve dynamic files.

Note: this is a security tool. If you see something wrong, open an issue in GitHub.

How it works?

The is_path_trav function is implemented in std::path::Path. It receives two paths, the base path and the path to check. To verify if the second is inside the first, path_trav turn paths into absolute and check if the second route contains the first.

Example 1.

Base : /home/user/data --> /home/user/data

Rel : ./data/folder --> /home/user/data/folder

Relative path is inside base path.

Example 2.

Base : /home/user/data --> /home/user/data

Rel : ./data/../../../etc/passwd --> /etc/passwd

Relative path isn't inside base path, tries to access sensitive data

Examples

First, add path_trav to your Cargo.toml

[dependencies]
path_trav = "2.0.0"

Then, on your main.rs file

use std::path::Path;
use path_trav::*;

fn main() {
    let server_folder       = Path::new("./");
    let server_file         = Path::new("./tests/test.rs");
    let important_file      = Path::new("~/../../etc/passwd");
    let non_existent_file   = Path::new("../weird_file");

    // Path is inside server_folder (Ok)
    assert_eq!(Ok(false), server_folder.is_path_trav(&server_file));

    // Path tries to acces sensitive data (Path Traversal detected)
    assert_eq!(Ok(true), server_folder.is_path_trav(&important_file));

    // File does not exists (ENOENT)
    assert_eq!(Err(ErrorKind::NotFound), server_folder.is_path_trav(&non_existent_file));
}

is_path_trav returns Result<bool, std::io::ErrorKind>. Unwrap it or use match to get the result. If returns true, there are path traversal.

Note: You can use it with PathBuf

use std::path:PathBuf

let server_folder   = PathBuf::from("./");
let server_file     = PathBuf::from("./tests/test.rs");

assert_eq!(Ok(false), server_folder.is_path_trav(&server_file));

Tests

There are a few integration tests in /tests folder where you can check the Path Trav behavior.

License

path_trav is licensed under the Apache 2.0 license.

Contribute

🥳 Any PR is welcome! Is a small project, so the guideline is to follow the code style and not make insane pruposes.

path_trav