highUser input reaching your database or shell

File Path Built From the Request

A file is opened using a name the caller controls, so the caller can point it outside the folder you meant.

Why it matters

Path segments like "../" are valid input, and join() and resolve() happily follow them. The result is a download endpoint that returns files it was never meant to serve. Keeping the resolved path inside the base folder is a two-line check.

What it looks like

This is the shape of code that triggers the rule. AI tools produce it because it works, and nothing tells them it is unsafe.

sendFile with a joined request param
app.get('/files/:name', (req, res) => {
  res.sendFile(path.join(__dirname, 'uploads', req.params.name));
});

The smallest fix

minimal patch
import path from 'node:path';
const base = path.resolve('uploads');
const target = path.resolve(base, path.basename(req.params.name));
if (!target.startsWith(base + path.sep)) {
  return res.status(400).json({ error: 'Invalid file name' });
}
res.sendFile(target);

The better fix

If you have a few more minutes, this is the approach that holds up as the app grows.

safe alternative
// Do not accept file names at all: store files under ids you generate,
// look the id up in the database, and serve the stored path.
const file = await db.files.findFirst({ where: { id: req.params.id, ownerId: user.id } });
if (!file) return res.status(404).end();
res.sendFile(file.storagePath);

Let your AI tool fix it

When the scanner finds this in your project, it fills in the file and line for you. This is the prompt it gives you to paste into Claude Code, Cursor or whatever you use.

In [the file] at line [the line number] a file path is built from request data: [the flagged code]. Resolve the path against a fixed base directory, reject it unless the resolved path starts with that base plus a separator, and strip directory components with path.basename. Better, look the file up by an id you issued and never accept a file name from the client.

How to check the fix worked

1. Request the endpoint with a name containing "../" and confirm a 400.
2. Request a real file name and confirm it is served.
3. Request a name for a file outside the folder and confirm a 400 or 404.

Further reading