Zip Slip in Gin with Bearer Tokens

Zip Slip is a path traversal vulnerability that occurs when an API constructs file paths by directly concatenating user-supplied input with a base directory. In a Gin-based API, this commonly happens when a handler uses a value from an Authorization header — such as a Bearer token — to build filesystem paths without proper validation. For example, a token value that includes sequences like ../ can traverse directory boundaries when appended to a path, potentially allowing access to files outside the intended directory. Because Bearer tokens are often treated as opaque strings, developers may mistakenly assume they cannot contain path traversal patterns, but an attacker can supply a crafted token that includes relative path segments.

In a black-box scan, middleBrick tests unauthenticated attack surfaces and can detect whether endpoints that accept Bearer tokens exhibit unsafe path construction. When OpenAPI specifications define security schemes using bearerAuth, the scanner cross-references the spec with runtime behavior to identify mismatches. A vulnerable endpoint might concatenate a token extracted from the Authorization header directly into a file path, for instance:

// Unsafe example: concatenating a Bearer token into a file path
func DownloadFile(c *gin.Context) {
    token := c.GetHeader("Authorization")
    // token might be "abc/../secret.txt" if improperly handled
    path := filepath.Join("/var/data/tokens", token)
    c.File(path)
}

Even if the intention is to use the token as a filename or identifier, failing to sanitize or validate the token allows directory traversal. The scanner’s checks include Input Validation and Property Authorization to surface such risky patterns, highlighting cases where Bearer token input reaches file system operations without normalization or strict allowlisting. Because the attack surface is tested without authentication, this class of issue is detectable without requiring valid credentials.
Additionally, if the API serves files based on token-derived identifiers, an attacker may leverage Zip Slip to read arbitrary files, leading to Data Exposure. The scanner’s Data Exposure and Inventory Management checks help surface these paths, while findings are mapped to frameworks such as OWASP API Top 10 to prioritize remediation.

To prevent Zip Slip when working with Bearer tokens in Gin, avoid using raw token values in filesystem paths. Instead, treat tokens as opaque identifiers and map them to safe internal references. If you must derive filenames, validate and sanitize all input rigorously and use a controlled mapping rather than direct concatenation.

Secure approach example that avoids path traversal by validating the token format and using a controlled lookup:

// Secure example: validate token and use a mapping
func DownloadFile(c *gin.Context) {
    token := c.GetHeader("Authorization")
    if token == "" {
        c.AbortWithStatusJSON(401, gin.H{"error": "authorization header required"})
        return
    }
    // Expect a Bearer token; extract the value after "Bearer "
    const prefix = "Bearer "
    if !strings.HasPrefix(token, prefix) {
        c.AbortWithStatusJSON(400, gin.H{"error": "invalid authorization format"})
        return
    }
    tokenValue := token[len(prefix):]
    // Validate token format (e.g., alphanumeric with limited length)
    if !regexp.MustCompile(`^[A-Za-z0-9\-_]+$`).MatchString(tokenValue) {
        c.AbortWithStatusJSON(400, gin.H{"error": "invalid token"})
        return
    }
    // Map token to a safe filename or internal ID
    safeFilename := mapTokenToFilename(tokenValue)
    path := filepath.Join("/var/data/tokens", safeFilename)
    // Ensure the resolved path remains within the base directory
    if !strings.HasPrefix(path, "/var/data/tokens"+string(os.PathSeparator)) {
        c.AbortWithStatusJSON(403, gin.H{"error": "forbidden"})
        return
    }
    c.File(path)
}

Additional remediation steps include using the middleBrick CLI to scan from terminal with middlebrick scan <url> to identify such issues in your API endpoints. For teams requiring continuous monitoring, the Pro plan supports 100 APIs with continuous scanning and GitHub Action integration to fail builds if risk scores drop below your configured threshold. The scanner checks for unsafe path construction and reports findings with severity and remediation guidance, but note that middleBrick detects and reports — it does not automatically fix or block requests.
When integrating into CI/CD, the GitHub Action can add API security checks to your pipeline, ensuring that endpoints accepting Bearer tokens are regularly assessed. Findings will include references to relevant checks such as Input Validation and BFLA/Privilege Escalation where applicable, helping you prioritize fixes based on severity and compliance mappings to standards like OWASP API Top 10 and PCI-DSS.