safePath()

Reject any request whose path tries to traverse out of bounds with .., before it reaches a handler.

Use case

Path traversal (../../etc/passwd) is a classic way to trick a file-serving handler into reading files outside its intended directory. If you serve files from a custom handler, safePath is an app-wide guard that blocks traversal attempts at the door, before any filesystem code runs.

How it works

It scans req.path for .. segments, including percent-encoded forms (it fully decodes before checking, so %2e%2e and friends cannot sneak past). A path containing a traversal attempt replies 403 Forbidden; a clean path calls next(). There are no options.

Configuration

No options. Add it once, app-wide, when any handler touches the filesystem based on the request path.

Example

Notes

rune's built-in static-file handler already guards traversal independently, so you do not need safePath just for static. It exists for custom file-serving handlers, where it gives you the same protection without re-implementing the decode-and-check logic yourself.

Next: back to the Middleware overview, or on to Validation & options.