Zip Slip in Chi with Basic Auth

Zip Slip is a path traversal vulnerability that occurs when an API constructs file paths using user-supplied input without proper validation. In the Chi web framework for Go, this risk can be compounded when endpoints protected with HTTP Basic Auth do not adequately validate or sanitize filename parameters before joining them to a base directory. Even though Basic Auth handles request authentication, it does not affect path handling; if a handler uses the username-supplied value directly in file operations, an attacker can traverse directories using sequences like ../../../etc/passwd.

Chi does not provide built-in path sanitization, so developers must explicitly validate and clean path components. When a Basic Auth–protected endpoint accepts a filename via a URL parameter or header and concatenates it with a base path (for example, to serve uploaded artifacts or logs), an unvalidated input enables directory traversal. The authentication layer confirms identity but does not constrain filesystem access, so a malicious actor who knows or guesses a valid credential can still exploit path traversal to read arbitrary files on the server.

Consider a Chi route that exports a user’s configuration by name:

r.Get("/export/{name}", func(w http.ResponseWriter, r *http.Request) {
    name := chi.URLParam(r, "name")
    path := filepath.Join("/var/data/exports", name)
    http.ServeFile(w, r, path)
})

If name is not restricted, an authenticated request with name=../../../etc/hosts can escape the intended directory. Basic Auth ensures the request comes from a known user, but it does not prevent the traversal. The scan checks whether resolved paths remain within the intended base directory and flags endpoints that join user input without canonicalization. This combination—authentication plus unsafe path construction—creates a scenario where confidentiality and integrity of the filesystem can be violated.

Moreover, if the API exposes an endpoint that writes files based on user input (e.g., downloading a report), an attacker can craft filenames such as ../../../secrets/api_keys.json to overwrite arbitrary files or leak sensitive information. The scanner’s checks include input validation and data exposure to detect these patterns, ensuring that path traversal risks are surfaced even when Basic Auth is in use.