Zip Slip in Axum with Cockroachdb

Zip Slip is a path traversal vulnerability that occurs when an application constructs file paths using user-supplied input without proper validation. In the context of an Axum web service that interfaces with Cockroachdb, the risk typically arises not from Cockroachdb itself, which is a distributed SQL database, but from how file paths are handled before data is written to or read from storage used in coordination with the database.

Consider an endpoint that accepts a user-provided filename or directory path to store or retrieve a file, and then records the path in Cockroachdb for later reference. If the application does not sanitize the input, an attacker can supply a path such as ../../../etc/passwd. When the server joins this input to a base directory using naive string concatenation or Path::join without canonicalization, the resulting path can escape the intended directory. This allows unauthorized file access or overwrite of critical files on the filesystem.

In Axum, handlers often receive JSON payloads containing a path field intended to be persisted alongside metadata in Cockroachdb. A vulnerable handler might look like:

use axum::{routing::post, Router};
use std::path::PathBuf;

async fn upload_handler(PathPayload { path }: PathPayload) -> String {
    // Unsafe: directly using user input to construct a filesystem path
    let full_path = PathBuf::from("/app/uploads").join(path);
    // ... write file to full_path, then store path in Cockroachdb
    format!(