The Path Traversal File Upload
#security-critical — production .env overwritten via upload
SRE: Attacker uploaded filename ../../.env to /api/attachments. Server resolved outside ./uploads/ and overwrote DB credentials.
The trap: concatenating user filename into path — ../ walks up the directory tree.
Your task
Fix `handleFileUpload()` in `traversal_server.js`: sanitize with `path.basename()` before saving to ./uploads/.
Book: check file extension · Prod: missing basename step compromises production secrets.
Skills you'll prove
Interview Tip
When asked how you secure file uploads or what path traversal is, say: "The biggest mistake developers make with file uploads is trusting the user-provided filename. If you concatenate it directly into your file path, an attacker can use directory traversal sequences like ../ to escape the intended directory and overwrite critical system files. I prevent this by always sanitizing the filename using path.basename(), which strips all directory paths and ensures the file can only be saved in the target directory. I also validate the file type by reading the magic bytes, not just trusting the extension."