logo

Database

Dart Unsafe Input Path Traversal Relative

Description

Detects potential path traversal vulnerabilities in Dart applications where file operations use relative paths from user input. This vulnerability could allow attackers to access files outside the intended directory by manipulating path inputs, potentially exposing sensitive files on the server.

Weakness:

063 - Lack of data validation - Path Traversal

Category: Unexpected Injection

Detection Strategy

    • Check if the application imports the 'shelf' or 'path' packages from Dart

    • Look for file operations (like File.read, File.write) that use relative paths

    • Verify if the file operation uses path parameters that could contain user-controlled input without proper sanitization

Vulnerable code example

import 'dart:io';
import 'package:shelf/shelf.dart' as shelf;

Future<shelf.Response> serveFile(shelf.Request req) async {
  final userInput = req.url.queryParameters['filename'];
  // VULNERABLE: Direct string concatenation allows path traversal
  final file = File('uploads/' + userInput);
  return shelf.Response.ok(await file.readAsString());...

✅ Secure code example

import 'dart:io';
import 'package:shelf/shelf.dart' as shelf;
import 'package:path/path.dart' as path;

Future<shelf.Response> serveFile(shelf.Request req) async {
  final userInput = req.url.queryParameters['filename'];
  if (userInput == null) {
    return shelf.Response.badRequest(body: 'Filename parameter is required');...