Code review: this endpoint returns a file from the server based on a name in the query string. What is wrong with it, and how would you fix it? ```csharp app.MapGet("/download", (string file) => { var path = Path.Combine("/var/app/reports", file); return Results.File(path, "application/octet-stream"); }); ```

1. How traversal works

root  = /var/app/reports
input = ../../../etc/passwd

Path.Combine(root, input) = /var/app/reports/../../../etc/passwd
Path.GetFullPath(...)     = /etc/passwd          ← outside the root

               /
               ├── etc/passwd   ◄─────────┐
               └── var/                   │ ..
                   └── app/      ◄───────┤ ..
                       └── reports/  ────┘ ..

2. Why Path.Combine makes it worse

Path.Combine("/var/app/reports", "/etc/passwd");   // "/etc/passwd"
Path.Combine(@"C:\reports", @"C:\Windows\win.ini"); // "C:\Windows\win.ini"

The documented behaviour is that a rooted argument resets the result. Path.Join does not do this, but still allows ...

3. The prefix check trap

root      = /var/app/reports
candidate = /var/app/reports-archive/secret.pdf
candidate.StartsWith(root) → true   ✘ wrong!

root + "/" = /var/app/reports/
candidate.StartsWith(root + "/") → false  ✔

4. Symbolic links

GetFullPath works on strings. If an attacker can create a symlink inside the root (for example via an upload that preserves links in an archive), the checked path can still point outside. Mitigations: do not extract links from untrusted archives, run with a low-privilege user, and check FileInfo.LinkTarget or resolve with ResolveLinkTarget(true) when links are possible.

5. Zip Slip

The same bug appears when extracting archives: an entry named ../../app/web.config overwrites files outside the target folder.

• ZipFile.ExtractToDirectory in modern .NET checks entries and throws IOException if an entry would land outside the destination.
• Manual extraction with entry.ExtractToFile(Path.Combine(dest, entry.FullName)) does not. Apply the same GetFullPath + prefix check per entry.

6. Defence in depth

7. Try it yourself

1. Run the vulnerable endpoint locally and call /download?file=../../../etc/hosts and /download?file=/etc/hosts.
2. Apply the safe version from the code example and confirm both return 404.
3. Try file=..%2F..%2Fetc%2Fhosts and file=reports-old/x to test encoding and the prefix trap.

// Best: users ask for an ID; the server owns the path
app.MapGet("/reports/{id:guid}", async (Guid id, ClaimsPrincipal user, ReportsDb db) =>
{
    var report = await db.Reports
        .Where(r => r.Id == id && r.TenantId == user.GetTenantId())
        .Select(r => new { r.StoragePath, r.FileName })
        .SingleOrDefaultAsync();

    return report is null
        ? Results.NotFound()
        : Results.File(report.StoragePath, "application/pdf", report.FileName);
}).RequireAuthorization();

// If you must accept a name: canonicalise and check containment
public static class SafePath
{
    private static readonly StringComparison Comparison =
        OperatingSystem.IsWindows() ? StringComparison.OrdinalIgnoreCase : StringComparison.Ordinal;

    public static bool TryResolve(string root, string userInput, out string fullPath)
    {
        fullPath = string.Empty;
        var name = Path.GetFileName(userInput);           // drop any directory parts
        if (string.IsNullOrWhiteSpace(name)) return false;

        var rootFull = Path.GetFullPath(root);
        if (!Path.EndsInDirectorySeparator(rootFull))
            rootFull += Path.DirectorySeparatorChar;

        var candidate = Path.GetFullPath(Path.Join(rootFull, name));
        if (!candidate.StartsWith(rootFull, Comparison)) return false;

        fullPath = candidate;
        return true;
    }
}

app.MapGet("/download", (string file) =>
    SafePath.TryResolve("/var/app/reports", file, out var path) && File.Exists(path)
        ? Results.File(path, "application/octet-stream", Path.GetFileName(path))
        : Results.NotFound())
   .RequireAuthorization();

// Manual zip extraction with a Zip Slip check
foreach (var entry in archive.Entries)
{
    var target = Path.GetFullPath(Path.Join(destRoot, entry.FullName));
    if (!target.StartsWith(destRoot + Path.DirectorySeparatorChar, StringComparison.Ordinal))
        throw new InvalidDataException($"Blocked entry outside target: {entry.FullName}");
    // ... create directory and extract
}