Potential fix for code scanning alert no. 24: Uncontrolled data used in path expression

[Rajeshcn26]

Potential fix for https://github.com/xebia/ShipServiceApp/security/code-scanning/24

In general, to fix uncontrolled path usage, you must ensure that user input cannot cause the application to read or write outside an intended directory. This is typically done by combining the user input with a trusted base directory, resolving the combined path to its canonical form, and then checking that the resolved path is still inside the base directory. Alternatively, if the input should be just a simple filename, you can reject any input that contains path separators or ...

For this endpoint, the intent is clearly to only serve files from /var/www/files/. The minimal change that preserves existing behavior is to (1) define a base directory, (2) safely combine it with filename using Path.Combine, (3) canonicalize the resulting path with Path.GetFullPath, and (4) verify that the canonical path starts with the canonical base directory plus a directory separator; if not, return BadRequest. This prevents traversal using .. or absolute paths while still allowing all legitimate filenames that live under the base directory.

Concretely in Controllers/VulnerableController.cs, inside DownloadFile we will:

• Introduce a baseDirectory string set to "/var/www/files".
• Use System.IO.Path.Combine(baseDirectory, filename) and then System.IO.Path.GetFullPath(...) to obtain filePath.
• Compute baseDirectoryFullPath = System.IO.Path.GetFullPath(baseDirectory) and check filePath.StartsWith(baseDirectoryFullPath + System.IO.Path.DirectorySeparatorChar). If this fails, return BadRequest("Invalid file path.").
• Keep the rest of the logic (existence check, read bytes, and return as download) unchanged.

We do not need any new using statements because we already refer to System.IO.File fully qualified, and we can similarly call System.IO.Path fully qualified.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[Copilot]

Pull request overview

This PR fixes a path traversal security vulnerability (code scanning alert #24) in the file download endpoint by implementing proper path validation and normalization.

Changes:

• Added path traversal protection to the DownloadFile method using Path.Combine, GetFullPath, and directory boundary validation
• Replaced direct string concatenation for file paths with secure path handling that prevents directory traversal attacks

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.