Unjailed Filesystem Path Traversal or Symlink Escape Across Polyglot I/O

Remediation checklist

• Go: open the trusted base directory with root, err := os.OpenRoot(baseDir) (defer root.Close()) and perform file I/O exclusively through *os.Root methods.
• TypeScript & JavaScript: canonicalize with fs.realpathSync and verify path.relative(realBase, realTarget) does not start with '..' or cross roots; Python: resolve via Path(base_dir).resolve() and enforce target.resolve().is_relative_to(real_base).
• Java & Kotlin: canonicalize via basePath.toRealPath() and enforce target.toRealPath().startsWith(realBase); C#: canonicalize with Path.GetFullPath and verify ordinal prefix containment with Path.DirectorySeparatorChar; Rust: reject ParentDir/RootDir and verify fs::canonicalize(target).starts_with(&real_base).
• C/C++: canonicalize with std::filesystem::weakly_canonical and verify component-wise prefix containment; Ruby: avoid Kernel#open/URI.open on dynamic strings and verify File.realpath containment with start_with?(real_base + '/'); PHP: reject stream wrappers, canonicalize with realpath(), and verify str_starts_with($realTarget, $realBase . DIRECTORY_SEPARATOR); Swift: enforce resolvingSymlinksInPath().standardizedFileURL containment.

Illustrative Code Examples

These fragments explain migration direction. They are not complete applications or compiler-verified patches for your project.

// Go: unjailed filepath.Join
data, err := os.ReadFile(filepath.Join(baseDir, userRelPath))

# Ruby: unjailed File.join + File.read
body = File.read(File.join(base_dir, params[:file]))

// PHP: unjailed path concatenation
$body = file_get_contents($baseDir . '/' . $_GET['doc']);

// Go 1.24+: kernel-enforced *os.Root confinement
root, err := os.OpenRoot(baseDir)
if err != nil { return nil, err }
defer root.Close()
data, err := root.ReadFile(userRelPath)

# Ruby: canonical realpath jail check
real_base = File.realpath(base_dir)
real_target = File.realpath(File.expand_path(user_rel, real_base))
raise ArgumentError, "path escape" unless real_target.start_with?(real_base + File::SEPARATOR)
body = File.binread(real_target)