Fixed-constraints-added-param-passed

[ShivamAher30]

#120 Issue: Path Traversal Vulnerability via Illegal URL Destination Parameter

Problem:
Normally, when passing the destination parameter, a file is downloaded. However, if characters like ../ are added and passed as a parameter after URL encoding, it enables access to files outside of the directory. For instance, the string ../test/jest-e2e.json, when URL encoded, can be passed as the destination parameter: localhost:3000/files/download/..%2Ftest%2Fjest-e2e.json. This results in the file being served as a response, potentially exposing sensitive information.
How to Recreate:

1. Pass a URL-encoded string containing ../ as the destination parameter.
2. Access the corresponding endpoint, for example: localhost:3000/files/download/..%2Ftest%2Fjest-e2e.json.
3. The content of the jest-e2e.json file is served as a response, revealing potentially sensitive data.
   How to Recreate:
4. Pass a URL-encoded string containing ../ as the destination parameter.
5. Access the corresponding endpoint, for example: localhost:3000/files/download/..%2Ftest%2Fjest-e2e.json.TestCase-1
6. The content of the jest-e2e.json file is served as a response, revealing potentially sensitive data.
7. Also passing ../.env as url encoded %2E%2E%2F%2Eenv leads to the path traversal and .env file being served TestCase-2

Solution:
To mitigate this vulnerability, we need to validate the destination parameter to ensure it does not contain any illegal characters or patterns that could lead to path traversal attacks. We can achieve this by implementing server-side validation and rejecting requests with invalid destination parameters.

Changes:

1. Implement validation checks for the destination parameter in the affected endpoint handler controller.
2. If the destination parameter contains illegal characters or patterns indicative of path traversal attempts, return an appropriate error response and do not serve the requested file.

[techsavvyash]

please add test cases

[techsavvyash]

why do we have this file?

[techsavvyash]

why do we have this file?

[techsavvyash]

will it handle all cases? i think the regex should just be allowing the <A-Z|0-8>.<A-Z> with the extension being optional. Please add relevant test cases to show that it works.