Description

This detector identifies path traversal vulnerabilities in Django applications where file paths are constructed using unsanitized user input. Path traversal attacks allow attackers to access files outside the intended directory by using sequences like "../" to navigate up the directory structure, potentially exposing sensitive system files or application data.

Detection Strategy

• Check if Django framework is imported in the application

• Identify file operations that open files using dynamic paths (such as open(), file operations, or path handling functions)

• Trace the data flow to determine if the file path comes from user-controlled input sources like HTTP requests, form data, or URL parameters

• Verify that the path input lacks proper sanitization or validation against path traversal patterns

• Report vulnerability when unsanitized user input is directly used in file path operations within Django applications

Vulnerable code example

def file_handler(request):
    filename = request.GET["file"]
    
    # VULNERABLE: User input directly passed to open() enables path traversal
    with open(filename, "r") as f:
        return f.read()

✅ Secure code example

import os
from pathlib import Path
from django.http import HttpResponse

BASE_DIR = Path("/opt/application/data")

def file_handler(request):
    filename = request.GET["file"]...