I am getting Path traversal file upload, a warning in my code. I can't understand how to fix that.
this is the error notification
Unsanitized input from an uploaded file flows into jimp.read, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.
here is my code
reqImage = req.files.readmoreImage;
await Jimp.read(reqImage.data)
.then((image) => {
image
.scaleToFit(263, 342, [
Jimp.HORIZONTAL_ALIGN_CENTER,
Jimp.VERTICAL_ALIGN_MIDDLE,
])
.quality(60)
.write(uploadPath);
})
.catch((err) => {
if (err) {
req.flash('error', 'Something wrong in image Uploading !');
return res.status(302).redirect('back');
}
});
how to sanitize before upload.
i have sanitize the string using regex like this .replace(/\//g, '\\\\')) but i cant understand to deal with file upload