Package io.karatelabs.http

Class PathSecurity

java.lang.Object

io.karatelabs.http.PathSecurity

public class PathSecurity
extends Object

Provides protection against path traversal attacks in resource resolution.

Path traversal attacks attempt to access files outside the intended directory by using sequences like ../ or encoded variants like %2e%2e/.

This class validates paths before they are used for resource resolution, rejecting any path that contains traversal sequences.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static class	PathSecurity.PathTraversalException	Exception thrown when a path traversal attempt is detected.

Constructor Summary

Constructors

Constructor	Description
PathSecurity()

Method Summary

Modifier and Type	Method	Description
static boolean	isSafe(String path)	Check if a path is safe (does not contain traversal sequences).
static void	validate(String path)	Validate a path and throw an exception if unsafe.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

PathSecurity

public PathSecurity()

Method Details

isSafe

public static boolean isSafe(String path)

Check if a path is safe (does not contain traversal sequences).

This method checks for:

• .. - Direct parent directory reference
• URL-encoded variants (%2e, %2E)
• Double-encoded variants
• Backslash variants (Windows-style)

Parameters:

path - the path to validate

Returns:

true if the path is safe, false if it contains traversal sequences

validate

public static void validate(String path)
                     throws PathSecurity.PathTraversalException

Validate a path and throw an exception if unsafe.

Parameters:

path - the path to validate

Throws:

PathSecurity.PathTraversalException - if the path contains traversal sequences