{"record":{"id":"aea738fcbbc439ba","repo":"perwendel/spark","slug":"classpath","errorCode":null,"errorMessage":"classpath","messagePattern":"classpath","errorType":"http","errorClass":"DirectoryTraversalDetection","httpStatus":400,"severity":"error","filePath":"src/main/java/spark/staticfiles/DirectoryTraversal.java","lineNumber":14,"sourceCode":"package spark.staticfiles;\n\nimport java.nio.file.Paths;\n\nimport static spark.utils.StringUtils.removeLeadingAndTrailingSlashesFrom;\n\n/**\n * Protecting against Directory traversal\n */\npublic class DirectoryTraversal {\n\n    public static void protectAgainstInClassPath(String path, String localFolder) {\n        if (!isPathWithinFolder(path, localFolder)) {\n            throw new DirectoryTraversalDetection(\"classpath\");\n        }\n    }\n\n    public static void protectAgainstForExternal(String path, String externalFolder) {\n    \tString unixLikeFolder = unixifyPath(externalFolder);\n        String nixLikePath = unixifyPath(path);\n        if (!isPathWithinFolder(nixLikePath, unixLikeFolder)) {\n            throw new DirectoryTraversalDetection(\"external\");\n        }\n    }\n    \n    private static String unixifyPath(String path) {\n    \treturn Paths.get(path).toAbsolutePath().toString().replace(\"\\\\\", \"/\");\n    }\n    \n    private static boolean isPathWithinFolder(String path, String folder) {\n    \tString rlatsPath = removeLeadingAndTrailingSlashesFrom(path);\n    \tString rlatsFolder = removeLeadingAndTrailingSlashesFrom(folder);","sourceCodeStart":1,"sourceCodeEnd":32,"githubUrl":"https://github.com/perwendel/spark/blob/1973e402f5d4c1442ad34a1d38ed0758079f7773/src/main/java/spark/staticfiles/DirectoryTraversal.java#L1-L32","documentation":"DirectoryTraversal.protectAgainstInClassPath guards Spark's static-file serving from the classpath: before mapping a requested URL path onto a local classpath folder, it verifies the resolved location stays within that folder. If the request path escapes the folder (e.g. via ../ sequences), Spark throws DirectoryTraversalDetection with the message \"classpath\", indicating a blocked directory traversal attempt.","triggerScenarios":"A request for a static classpath resource whose relative path resolves outside the configured classpath local folder, e.g. requesting /../../etc/passwd style paths against staticFiles.location(\"/public\").","commonSituations":"Security scanners or attackers probing static file endpoints with ../, ..\\, or encoded traversal sequences; misconfigured reverse proxies forwarding odd paths; legitimate deep relative links that accidentally escape the resource root.","solutions":["Locate the request URL that escaped the classpath folder and remove/fix the offending link or client.","Keep static file locations shallow and canonical; avoid symlinks or entries pointing outside the resource root.","If a scan triggered it, no code change is needed — the protection worked as intended; consider logging/blocking the source."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"Path root = Paths.get(localFolder).toAbsolutePath().normalize();\nPath candidate = root.resolve(requestPath).normalize();\nboolean safe = candidate.startsWith(root);","typeGuard":null,"tryCatchPattern":"try {\n    DirectoryTraversal.protectAgainstInClassPath(path, localFolder);\n} catch (DirectoryTraversalDetection e) {\n    respond(403, \"Forbidden\");\n}","preventionTips":["Sanitize request paths (normalize and reject ../) before serving static files.","Keep classpath resource roots free of symlinks pointing outside.","Log blocked traversal attempts and alert on patterns."],"tags":["security","directory-traversal","static-files","spark"],"backgroundTag":"path-traversal-blocked","analyzedSha":"1973e402f5d4c1442ad34a1d38ed0758079f7773","analyzedAt":"2026-09-10T14:38:22.866Z","contentChangedAt":"2026-09-10T14:38:22.866Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}