What is path traversal, and how does the path module (specifically path.normalize() and careful path.join() usage) help prevent it as a security vulnerability?

Path traversal is a vulnerability where user-supplied input containing '../' sequences is used to construct a file path, potentially letting an attacker escape an intended directory and access arbitrary files elsewhere on the filesystem (like reading /etc/passwd via a crafted upload filename) -- prevention involves normalizing and validating that a constructed path still remains within the intended base directory after resolution, since path.join() alone does normalize '..' segments but doesn't prevent them from still resulting in a path outside the intended directory.

const path = require('node:path');

function getSafeFilePath(baseDir, userSuppliedFilename) {
  const resolvedPath = path.resolve(baseDir, userSuppliedFilename);
  if (!resolvedPath.startsWith(path.resolve(baseDir) + path.sep)) {
    throw new Error('Path traversal attempt detected');
  }
  return resolvedPath;
}

// getSafeFilePath('/app/uploads', '../../etc/passwd') -- throws, correctly blocked