CRITICAL: Path traversal in storage handler - no key sanitization

[poyrazK]

Why is this an issue?

In internal/handlers/storage_handler.go:44-55, object keys are not validated for path traversal patterns (../, ..\\). Malicious keys could access unauthorized paths.

What is causing it?

// contentDispositionAttachment sanitizes filename but key itself not validated
c.Header("Content-Disposition", contentDispositionAttachment(key))
// key passed directly to storage service without validation

How can it be solved?

Add key validation before storage operations:

if strings.Contains(key, "..") {
    return NewHTTPError(http.StatusBadRequest, "invalid key")
}

Category

• Small
• Medium
• Large

Severity

• Low
• Medium
• High
• Critical