detecting-path-traversal

Run the scan_pathtraversal.py script against your source directory, which uses Semgrep rules or a grep fallback to find candidates like @RequestParam values passed into Paths.get() or new File(). Each candidate is then verified in context to confirm exploitability.

ZipSlip is a path traversal flaw where ZIP entry names containing ../ write files outside the extraction directory. The scanner flags new File(dest, entry.getName()) calls that lack a getCanonicalPath() check confirming the output stays within the destination directory.

Yes, it falls back to regex-based grep scanning when Semgrep is unavailable, though with lower recall. The script prints a fallback warning since zero findings under grep fallback does not guarantee the code is safe.

Blacklist filters checking for literal ../ strings can be bypassed with URL encoding (%2e%2e%2f), double encoding, or Unicode normalization. The recommended fix is getCanonicalPath() normalization followed by a startsWith() check against the canonical allowed base directory.

Code is safe when getCanonicalPath() plus startsWith(canonicalBase) validation is present, when whitelist ID mapping hides real paths from users, or when paths come entirely from server-side constants. These patterns are excluded during AI context verification.