Zip Slip in Gin with Cockroachdb

Zip Slip is a path traversal vulnerability that occurs when an application constructs file paths by directly concatenating user-supplied input with a base directory. In a Gin application that uses CockroachDB, the risk emerges not from CockroachDB itself, but from how file paths are built before any database interaction. If a handler accepts a filename or archive entry from a request and uses it to extract files or build filesystem paths without strict validation, an attacker can provide crafted input such as ../../../etc/passwd to escape the intended directory. This becomes especially relevant when the application stores or references files in a directory served by CockroachDB-backed metadata or configuration, potentially exposing sensitive data or enabling unauthorized file access. For example, an import endpoint that extracts a user-uploaded archive may traverse outside the target folder if path sanitization is missing. Because the scan tests unauthenticated attack surfaces, middleBrick can flag such path traversal risks during its security checks, identifying unsafe handling of user input in file operations. Even though CockroachDB is a distributed SQL database and does not directly manage filesystem paths, insecure file handling in Gin routes can lead to data exposure or unauthorized reads that indirectly affect data integrity and confidentiality. MiddleBrick’s checks for Input Validation and Data Exposure help detect these weaknesses by analyzing request handling patterns and identifying unsafe path concatenation. Developers must ensure that any filename used in filesystem operations is validated, normalized, and confined to an allowed directory, regardless of whether CockroachDB is involved in storing file metadata. This prevents attackers from leveraging path traversal to access or overwrite critical files on the host system.

To mitigate Zip Slip in a Gin application interacting with CockroachDB, enforce strict path validation and avoid direct concatenation of user input into filesystem paths. Use Go’s path/filepath package to clean and validate paths, ensuring they remain within a designated base directory. Below is a secure example of a Gin handler that accepts a filename, sanitizes it, and safely constructs a path before any filesystem operation, while using CockroachDB for storing file metadata. This approach prevents directory traversal regardless of the database in use.

import (
    "net/http"
    "path/filepath"
    "strings"

    "github.com/gin-gonic/gin"
    "github.com/lib/pq"
    "database/sql"
    _ "github.com/cockroachdb/cockroach-go/v2/crdb"
)

var db *sql.DB // Assume initialized CockroachDB connection

func uploadHandler(c *gin.Context) {
    // User input from form field "filename"
    userFile := c.PostForm("filename")
    baseDir := "/safe/upload/dir"

    // Sanitize and validate the filename
    cleanName := filepath.Clean("/" + userFile) // Clean to remove ".." elements
    if cleanName == "/" || strings.Contains(cleanName, "..") {
        c.AbortWithStatusJSON(http.StatusBadRequest, gin.H{"error": "invalid filename"})
        return
    }

    // Build full path ensuring it stays within baseDir
    fullPath := filepath.Join(baseDir, cleanName)
    if !strings.HasPrefix(fullPath, filepath.Clean(baseDir)+string(filepath.Separator)) {
        c.AbortWithStatusJSON(http.StatusForbidden, gin.H{"error": "path traversal attempt"})
        return
    }

    // Proceed with filesystem operation (e.g., save file)
    // ...

    // Store metadata in CockroachDB securely using parameterized queries
    _, err := db.Exec("INSERT INTO files (name, path) VALUES ($1, $2)", userFile, fullPath)
    if err != nil {
        c.AbortWithStatusJSON(http.StatusInternalServerError, gin.H{"error": "database error"})
        return
    }

    c.JSON(http.StatusOK, gin.H{"status": "uploaded"})
}

This code ensures that user input is cleaned and validated before path construction, preventing Zip Slip. The CockroachDB interaction uses parameterized queries to avoid SQL injection, which is a separate concern but equally important. MiddleBrick’s CLI can be used to scan this endpoint and verify that no path traversal or injection issues are present. For teams using the Pro plan, continuous monitoring can catch regressions in file handling logic during CI/CD runs, while the GitHub Action can fail builds if new routes introduce unsafe path handling. Developers should also consider applying the same validation discipline to any dynamic path generation involving database-driven configurations or stored file references.