Description

This detector identifies path traversal vulnerabilities in FastAPI applications where user input flows to file deletion operations. Path traversal attacks allow attackers to delete files outside of the intended directory by using sequences like '../' to traverse the file system hierarchy, potentially compromising system integrity and availability.

Detection Strategy

• The application must import the FastAPI library

• Code must contain file deletion operations (using functions like os.remove, os.unlink, pathlib.unlink, shutil methods, or other file deletion APIs)

• User input from FastAPI endpoints (path parameters, query parameters, request body, etc.) must flow to the file deletion operation

• The user input must be used as a file path argument without proper sanitization or validation to prevent directory traversal

Vulnerable code example

import os
from pathlib import Path
from fastapi import FastAPI, Query

app = FastAPI()
BASE_DIR = Path("/var/www/uploads")

@app.delete("/file")...

✅ Secure code example

import os
from pathlib import Path
from fastapi import FastAPI, Query, HTTPException

app = FastAPI()
BASE_DIR = Path("/var/www/uploads").resolve()

@app.delete("/file")...