Traversal Trap

A download handler joins a public directory with a caller-supplied filename. Use its responses to test whether the resolved path stays inside that directory.

Objective

Demonstrate a bounded relative-path traversal.
Explain why normalized-path containment must precede file access.

Before you begin

Open /challenge/hard/traversal and follow its deployment handover link. The note contains an inventory, maintenance details, and routine checks. Use it to identify the document directory and the internal acceptance file; you do not need an instructor to supply a location. Keep your investigation within this exercise's virtual file set.

Concepts

Joining a trusted base to untrusted text is unsafe when parent-directory segments can escape the base. Filters should normalize the candidate path and verify containment beneath an approved root.

A requested path is resolved under a trusted base and checked for containment. Only an allowed, authorized file reaches file access.

Resolve the requested path using one defined decoding and normalization policy, including symbolic-link handling. Check directory ancestry under the trusted base, then check authorization before opening the file. A text-prefix comparison is not a containment check; prevent the resolved object from changing between the check and the open.

Suggested tools

Browser or HTTP client: Edit one name query parameter and compare text responses.

Tool practice

Rehearse the worked tool exercise before using challenge data.

Keep a path inside the filename query value distinct from the URL route itself. Quote the full URL in a terminal. Read the handover, then record one missing-file response. Compare the inventory's root with the base shown in that response before constructing a bounded request.

Investigation

Observe

Read the handover's inventory and distinguish the public document from the internal acceptance material. Compare a successful public filename with a missing filename. Record the base directory that the error reveals.

Form a hypothesis

Which relative path would leave that base and reach the named sibling directory?

Test carefully

Request only the internal acceptance file identified by the handover; do not enumerate the host filesystem.

Progressive hints

Hint 1

Compare briefing.txt with one missing name.

Hint 2

A parent segment leaves the current directory.

Hint 3

Draw the folders from the handover inventory, then build a relative path from the public base to the internal acceptance file.

Troubleshooting and reset

Keep the name parameter URL-safe and inspect the text error. Use the shortest ordinary slash-separated relative path: the exercise models a small virtual file set, not a general filesystem with every equivalent path spelling. If the briefing is only one sentence, the board has an older application; it needs the artifact update before this guide applies. In-game hints are session-specific; a restart clears them and all other progress.