Coming soon

Security training for developers, in the code they write.

Most serious attacks work because something blends in. Ghillie Field School trains developers to notice what doesn't belong, in realistic code in their own language, and explains every answer.

files.jsJavaScript · Express

// GET /files?name=report.pdf
app.get("/files", requireUser, (req, res) => {
  const file = path.join(UPLOAD_DIR, req.query.name);
  res.sendFile(file);
});

three reviewers approved this. can you see it?

Show me

here.

Line 3 const file = path.join(UPLOAD_DIR, req.query.name);

What was hiding

Path traversal (CWE-22). path.join tidies a path, and tidying it follows ../. A request for ?name=../../etc/passwd walks out of the upload folder.

Why it blended in

Joining paths with path.join looks like the careful way to build one, and the route already checks that someone is signed in. It doesn't check which files they may read.

How it's fixed

Give sendFile the folder as its root, so it refuses a name that climbs out of it: res.sendFile(req.query.name, { root: UPLOAD_DIR }).

  • Single sign-on with Microsoft Entra ID, Okta, Google Workspace, or any OIDC or SAML provider. No passwords: email codes and passkeys only.
  • Code exercises in C#, Java, JavaScript/TypeScript or Python
  • Mapped to OWASP Top 10:2025, CWE and ASVS 5.0
  • Signed training evidence for PCI DSS 6.2.2

Ghillie Field School