react-doctor/path-traversal-risk

Building a filesystem path from request input lets an attacker use `..` or absolute paths to read or write files outside the intended directory.

Validation prompt

Confirm the detector match and collect the required evidence before deciding whether an edit is warranted.

Fires when readFile/readFileSync/writeFile/writeFileSync( takes a first argument that is: or a template literal containing: request data (req./request./params./query./body./parsed.), or when path.join(/path.resolve( includes one of those accessors. A negative lookbehind keeps a literal filename segment like 'render-query.js' (the query. inside a string) from matching, and comments are stripped first.

Suppress when: the request value is already validated/normalized against a fixed base directory (basename-only, traversal rejected) before the fs/path call: the static check sees the accessor but not the upstream sanitization: or the matched req./query. is a property of a non-request object that happens to share the name.

Evidence boundary

The diagnostic proves only that the detector’s modeled source pattern matched. It does not prove runtime impact, product intent, rendered failure, or that one remediation is correct.

Establish the environment, repository policy, exceptions, and required rendered or runtime evidence before deciding the occurrence.

Record one outcome:

• Confirmed failure: The required evidence establishes the violation.
• Rejected: A documented exception or false-positive predicate applies.
• Needs evidence: Named evidence can still be collected.
• Unavailable: Required evidence cannot be collected in this run.
• Waived with evidence: An authorized, scoped exception applies to an established failure.
• Observation: The review records an optional tradeoff without claiming a defect.

A waiver records its scope, authority, evidence, and review condition. It is not a pass or false positive.

Default severity is registry metadata. Use the occurrence’s JSON severity after repository configuration when ordering real findings.

Fix prompt

Apply this candidate correction only after the required evidence confirms the risk.

Map user-visible identifiers to server-owned paths (look up an allowlisted filename by id) instead of joining caller input directly. When a path must come from input, take only path.basename(...), then path.resolve(BASE, input) and confirm the result still starts with BASE so .. or absolute paths cannot escape. Never pass req, params, query, or body data into fs calls unchecked.

Repository-wide copy prompt

Use this repository-wide prompt only after validating each occurrence. For one occurrence, use the guidance above.