Container Escape in Strapi (Typescript)

Mitigating container escape risks in a Strapi + TypeScript application requires defensive coding practices focused on input validation, path sanitization, and principle of least privilege. Since middleBrick detects such issues as part of its Input Validation and Property Authorization checks, developers can use its findings to prioritize fixes. The following TypeScript examples show how to secure file operations in Strapi custom code.

Consider a vulnerable controller method that serves user-uploaded files but fails to validate the file path:

// src/api/file/controllers/file.ts (VULNERABLE)
import { ctx } from 'koa';

export default {
  async download(ctx) {
    const { filename } = ctx.params;
    const filePath = `./public/uploads/${filename}`; // No validation
    ctx.sendFile(filePath);
  }
};

An attacker could request /file/download/../../../etc/passwd to read host files. The fix involves validating that the resolved path stays within the intended directory using Node.js path module and ensuring TypeScript types guide safe handling:

// src/api/file/controllers/file.ts (SECURE)
import { ctx } from 'koa';
import { resolve, relative } from 'path';

const UPLOAD_DIR = resolve('./public/uploads');

export default {
  async download(ctx) {
    const { filename } = ctx.params;
    if (typeof filename !== 'string' || !filename.match(/^[a-zA-Z0-9._-]+$/)) {
      ctx.badRequest('Invalid filename');
      return;
    }
    const filePath = resolve(UPLOAD_DIR, filename);
    // Ensure the resolved path is still within UPLOAD_DIR
    if (relative(UPLOAD_DIR, filePath).startsWith('..')) {
      ctx.forbidden('Access denied');
      return;
    }
    try {
      await ctx.sendFile(filePath);
    } catch (err) {
      ctx.notFound();
    }
  }
};

This approach uses TypeScript to enforce string types and combines runtime checks with path resolution to prevent directory traversal. Additionally, developers should:

• Run Strapi containers as non-root users (e.g., USER node in Dockerfile).
• Avoid mounting host directories like /var/run/docker.sock or /host unless absolutely necessary.
• Drop Linux capabilities (CAP_SYS_ADMIN, etc.) using securityContext in Kubernetes or --cap-drop in Docker.
• Use middleBrick to scan the API for input validation issues — particularly endpoints accepting file paths, user input in file operations, or dynamic imports — and prioritize fixes based on severity.

By combining secure TypeScript practices with proper container hardening, the risk of container escape is significantly reduced, even if application-layer flaws exist.