From 2b3a9cd463150a7190318d32cfa7c1f2001bad66 Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Thu, 26 Mar 2026 09:13:01 +0000
Subject: [PATCH] fix: resolve CodeQL alert #30 - Uncontrolled data used in
 path expression

---
 vulnerable_path_traversal.py | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/vulnerable_path_traversal.py b/vulnerable_path_traversal.py
index 8f83550..847c1fe 100644
--- a/vulnerable_path_traversal.py
+++ b/vulnerable_path_traversal.py
@@ -22,7 +22,10 @@ def read_file():
 @app.route('/view')
 def view_document():
     doc = request.args.get('doc')
-    path = f"/documents/{doc}"
+    base_dir = os.path.realpath("/documents/")
+    path = os.path.realpath(os.path.join(base_dir, doc))
+    if not path.startswith(base_dir):
+        return 'Access denied', 403
     
     with open(path) as file:
         return file.read()