Zip Slip in Buffalo with Bearer Tokens

Zip Slip is a path traversal vulnerability that occurs when an API constructs file paths from user-supplied input without proper validation. In Buffalo, this risk is amplified when endpoints rely on Bearer Tokens for authorization but do not enforce strict path controls. A typical scenario: an authenticated handler uses a token to identify a user (e.g., via an Authorization header like Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9) and then uses a user-provided filename to read or extract files. If the filename contains sequences like ../, and the server does not sanitize or restrict the destination path, an attacker can traverse outside the intended directory. Because the request is authorized by a Bearer Token, the server may trust the authenticated context and skip additional authorization checks on the resulting file path. This combination leads to unauthorized file access, information disclosure, or even write operations depending on file handling logic.

Consider an endpoint in Buffalo that serves user-uploaded documents. The handler validates the Bearer Token to confirm identity but then directly joins the filename to a base directory:

// Unsafe: joining user input without path cleaning
base := "./uploads"
filename := c.Params().Get("filename")
fullPath := filepath.Join(base, filename)
data, err := os.ReadFile(fullPath)

An attacker can supply filename=../../../etc/passwd, causing filepath.Join to produce ./uploads/../../../etc/passwd, which resolves outside the uploads directory. Because the request presented a valid Bearer Token, the handler assumes authorization is sufficient, but path traversal bypasses intended access controls. The scan dimension relevant here includes Input Validation and BOLA/IDOR checks, which would flag unsafe path construction and missing ownership checks even when authentication succeeds.

Additionally, if the API exposes an endpoint that extracts archives (e.g., ZIP files) provided by the user, malicious archives containing paths with ../ can write files outside the intended directory during extraction. This becomes more dangerous when the server uses Bearer Tokens to identify tenants but does not scope file operations to tenant-specific directories. The scan’s Inventory Management and Property Authorization checks would highlight missing tenant-aware path scoping and unsafe consumption of uploaded archives.

Remediation focuses on strict input validation, path sanitization, and tenant-aware scoping, even when Bearer Tokens confirm identity. Always treat user input as untrusted, regardless of authentication state.

1. Validate and clean file paths

Use filepath.Clean and ensure the resolved path remains within the intended base directory. Do not rely on filepath.Join alone, as it can still traverse upward with crafted inputs.

// Safe: ensure the cleaned path stays within base
base := "./uploads"
filename := c.Params().Get("filename")
relPath := filepath.Clean(filename)
if strings.HasPrefix(relPath, "..") || strings.Contains(relPath, "..") {
    c.Error(400, errors.New("invalid filename"))
    return
}
fullPath := filepath.Join(base, relPath)
// Ensure fullPath is still inside base
if !strings.HasPrefix(fullPath, filepath.Clean(base)+string(os.PathSeparator)) {
    c.Error(403, errors.New("access denied"))
    return
}
data, err := os.ReadFile(fullPath)

2. Scope operations to tenant-specific directories using Bearer Token claims

When using JWT Bearer Tokens, extract tenant or user ID from claims and enforce it as a directory prefix. This ensures that even if path traversal is attempted, the filesystem scope is limited.

// Example: extract tenantID from JWT claims validated by middleware
tenantID := "tenant_123" // derived from token claims, e.g., c.Get("claims").(jwt.MapClaims)["tenant_id"]
base := filepath.Join("./uploads", tenantID)
filename := c.Params().Get("filename")
relPath := filepath.Clean(filename)
fullPath := filepath.Join(base, relPath)
if !strings.HasPrefix(filepath.Clean(fullPath), filepath.Clean(base)) {
    c.Error(403, errors.New("access denied"))
    return
}
data, err := os.ReadFile(fullPath)

3. Secure archive extraction

When handling ZIP or tar archives, use a library that blocks path traversal and absolute paths. For example, use github.com/klauspost/pcompress/gzip or ensure each file header is validated before writing.

// Safe extraction with path validation
zr, err := zip.OpenReader(archivePath)
if err != nil {
    c.Error(500, err)
    return
}
defer zr.Close()
for _, f := range zr.File {
    path := filepath.Clean(f.Name)
    if !strings.HasPrefix(path, "validated_prefix") || f.PathContainsTraversal() {
        c.Error(400, errors.New("invalid archive entry"))
        return
    }
    // extract safely
}

These steps align with findings from the 12 security checks. Authentication and Bearer Token usage are verified, but the remediation ensures that Input Validation, Property Authorization, and BOLA/IDOR checks pass by enforcing least privilege and strict path controls.