FileDrop’s path traversal flaw comes from using a registration-time username as a filesystem directory. Although the app applies path.basename to filenames, it does not make the username safe before joining it into a storage path. In the article’s POSIX-style example, an account named x/../casey can resolve to Casey’s directory, defeating the promise that each account’s files are private. The key lesson: a value does not become trusted just because it came from a database record or a verified JWT.
How FileDrop is meant to protect files
FileDrop is described as a personal file-storage service with an Express/Node backend, a React single-page frontend, MongoDB user records, filesystem-based file storage, and JWT bearer tokens in the Authorization header. Users can sign in, upload, list, download, and delete files. Its stated design promise is: “Every account has its own storage area on disk; the files in it are private to that account.”
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Alice and Bob Learn Secure Coding | $30.25 | Buy on Amazon |
| 2 |
|
The Secure Vibe Coding Handbook: A Practical Guide to Safe and Secure AI Programming | $14.99 | Buy on Amazon |
| 3 |
|
Secure Coding in C And C++ | $29.99 | Buy on Amazon |
| 4 |
|
Secure Coding: Principles and Practices | $39.98 | Buy on Amazon |
| 5 |
|
Secure Coding in C and C++ (SEI Series in Software Engineering) | $71.99 | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
The review follows the security boundary through the whole application: understand the user stories, locate user-controlled inputs, trace them to sensitive operations, identify which defenses apply, demonstrate the flaw, and select a fix that addresses the underlying trust problem.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Where the path becomes unsafe
FileDrop constructs a file location from the storage root, the authenticated user’s username, and a filename. The filename is reduced to its basename, but the username is not constrained to a safe single directory name. Registration checks its type and length, yet the solution article reports that separators and dot segments remain possible. Since the username originated with the user, storing it in MongoDB or carrying it in a JWT does not make it safe for a filesystem path.
#1 Best Overall
Node.js documents that path.join() joins path segments using the platform-specific separator and normalizes the result; path.normalize() resolves . and .. segments. Consequently, checking only the filename leaves another path component uncontrolled.
How the example payloads resolve
The solution article uses a POSIX-style storage-root example. The outcomes below describe that example, not universal path syntax across operating systems:
| Username | Normalized destination in the example | Inside storage root? |
|---|---|---|
../casey |
A neighboring path outside the storage root | No |
x/../casey |
Casey’s folder under the storage root; .. cancels the preceding x segment |
Yes, but it is another user’s folder |
The second case is an access-control failure even though normalization leaves the destination inside the storage root. The important boundary is not merely “inside the application’s storage”; it is whether this user is authorized to reach that specific account’s directory.
What the flaw can expose
The solution article’s proof of concept registers an account with a traversal username and then uses the ordinary authenticated file API to view and download another account’s files. It says the same path construction can affect upload and delete operations, enabling overwrites or deletion as well. These are behaviors attributed to that solution article; the exploit was not independently executed here. The article classifies the issue as Path Traversal (CWE-22) and External Control of File Name or Path (CWE-73).
Rank #3
Why the existing defenses do not fix it
The article reports that API file routes require authentication and JWT verification pins HS256; it also describes filename basename handling, MongoDB operator-injection defenses, and React JSX escaping. Those controls address other risks, but none establishes that a username-derived directory belongs to the authenticated user.
- Authentication establishes which account made a request; it does not make every value associated with that account safe for path construction.
- Filename basename handling constrains the filename component, not the separate username component.
- JWT verification verifies the token according to the configured algorithm; it does not change the origin or trust level of a username originally chosen at registration.
- Output escaping and database-input checks address rendering and database query concerns, not filesystem path traversal.
How to fix the storage identity
Prefer a server-generated immutable directory ID
Use a server-generated, immutable user identifier for the on-disk directory rather than a display name or username. This removes attacker-chosen username text from the path identity and is the stronger of the two main fixes described by the solution article. Usernames can remain account labels without also controlling where files are stored.
Rank #4
- Used Book in Good Condition
Use a strict username allowlist as a supporting defense
If a username must participate in a path, validate it against a strict allowlist that excludes separators and dot segments. This helps block the demonstrated input, but it keeps filesystem identity coupled to a user-facing value. Treat validation as defense in depth, not as a substitute for a server-generated directory key.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Verify the final path and every file operation
- Resolve the storage root and the intended account directory, then verify that the resolved directory remains beneath the resolved storage root. A simple string-prefix comparison is not a reliable containment check because path boundaries and similarly prefixed directory names matter.
- Apply the same containment protection wherever a path is used. In particular, validate the upload destination in the middleware callback: upload middleware may write a file before the route handler runs.
- Retain basename handling for filenames, but do not treat it as protection for other path components.
- Track file ownership in the database and check it for downloads and deletes. Authorization should be tied to the file record, not inferred only from a constructed path.
A practical review sequence for similar code
- Map the promise and operations. Identify what users expect to be private and enumerate list, download, upload, overwrite, and delete paths.
- Trace each path component to its origin. Follow values from registration, request parameters, database fields, and token claims back to where they were first supplied.
- Identify the filesystem sinks. Inspect path construction and the code that opens, lists, writes, or removes files, including upload middleware that runs before route logic.
- Test normalization and authorization separately. Ask both whether the resolved path stays within the storage root and whether the authenticated user owns the target directory or file.
- Use an identity that users cannot choose. Prefer a server-generated directory key, then retain containment checks and ownership authorization as independent safeguards.
The core review question is not simply whether a field is sanitized at the final sink. It is whether every value reaching that sink is safe for its role and tied to the correct authorization boundary.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
