الـ File System والـ paths: قراية وكتابة صح، ومن غير path traversal

import path from "node:path";

console.log(path.join("uploads", "avatars", "mona.png"));
console.log(path.join("uploads", "../config", "./secret.env"));
console.log(path.resolve("uploads", "mona.png").replace(process.cwd(), "<cwd>"));
console.log(path.resolve("/etc", "passwd"));

const file = "/srv/app/uploads/report.final.pdf";
console.log(path.dirname(file), path.basename(file), path.extname(file));
console.log(path.parse(file).name);

console.log(process.cwd() === import.meta.dirname);

$ node main.js
uploads/avatars/mona.png
config/secret.env
<cwd>/uploads/mona.png
/etc/passwd
/srv/app/uploads report.final.pdf .pdf
report.final
true

import fs from "node:fs/promises";
import path from "node:path";

const dir = path.join(import.meta.dirname, "data", "users");
await fs.mkdir(dir, { recursive: true });

await fs.writeFile(path.join(dir, "7.json"), JSON.stringify({ id: 7, name: "مُنى" }));
await fs.writeFile(path.join(dir, "8.json"), JSON.stringify({ id: 8, name: "عمر" }));

const entries = await fs.readdir(dir, { withFileTypes: true });
for (const e of entries) {
  const info = await fs.stat(path.join(dir, e.name));
  console.log(e.name, e.isFile(), info.size, "bytes");
}

const user = JSON.parse(await fs.readFile(path.join(dir, "7.json"), "utf8"));
console.log(user);

try {
  await fs.readFile(path.join(dir, "99.json"), "utf8");
} catch (err) {
  console.log(err.code, err.code === "ENOENT" ? "← مش موجود، رجّع 404" : "");
}

$ node main.js
7.json true 26 bytes
8.json true 24 bytes
{ id: 7, name: 'مُنى' }
ENOENT ← مش موجود، رجّع 404

import fs from "node:fs/promises";
import path from "node:path";
import crypto from "node:crypto";

// كتابة atomic: يا الملف الجديد كله، يا القديم كله
async function writeAtomic(file, data) {
  const tmp = `${file}.${crypto.randomUUID()}.tmp`;
  await fs.writeFile(tmp, data);
  await fs.rename(tmp, file);
}

await writeAtomic("settings.json", JSON.stringify({ maintenance: false }));
await writeAtomic("settings.json", JSON.stringify({ maintenance: true }));
console.log(await fs.readFile("settings.json", "utf8"));
console.log((await fs.readdir(".")).filter((f) => f.endsWith(".tmp")).length, "ملفات tmp فاضلة");

try {
  await fs.writeFile("settings.json", "x", { flag: "wx" });
} catch (err) {
  console.log(err.code, "← wx: اكتب بس لو مش موجود");
}

$ node main.js
{"maintenance":true}
0 ملفات tmp فاضلة
EEXIST ← wx: اكتب بس لو مش موجود

import fs from "node:fs/promises";
import path from "node:path";

const PUBLIC = path.join(import.meta.dirname, "public");
await fs.mkdir(PUBLIC, { recursive: true });
await fs.writeFile(path.join(PUBLIC, "hello.txt"), "ملف عام");
await fs.writeFile(path.join(import.meta.dirname, ".env"), "DB_PASSWORD=super-secret");

// ❌ نسخة فيها ثغرة
async function readPublic(userPath) {
  return fs.readFile(path.join(PUBLIC, userPath), "utf8");
}

console.log(await readPublic("hello.txt"));
console.log(await readPublic("../.env"));

$ node main.js
ملف عام
DB_PASSWORD=super-secret

import fs from "node:fs/promises";
import path from "node:path";

const PUBLIC = path.join(import.meta.dirname, "public");
await fs.mkdir(PUBLIC, { recursive: true });
await fs.writeFile(path.join(PUBLIC, "hello.txt"), "ملف عام");
await fs.writeFile(path.join(import.meta.dirname, ".env"), "DB_PASSWORD=super-secret");


async function safeRead(userPath) {
  let decoded;
  try {
    decoded = decodeURIComponent(userPath);
  } catch {
    return { status: 400, body: "bad encoding" };
  }
  if (decoded.includes("\0")) return { status: 400, body: "bad path" };

  const full = path.resolve(PUBLIC, decoded);
  if (!full.startsWith(PUBLIC + path.sep)) return { status: 403, body: "forbidden" };

  try {
    return { status: 200, body: await fs.readFile(full, "utf8") };
  } catch (err) {
    if (err.code === "ENOENT") return { status: 404, body: "not found" };
    if (err.code === "EISDIR") return { status: 403, body: "forbidden" };
    throw err;
  }
}

const cases = ["hello.txt", "../.env", "%2e%2e/.env", "/etc/passwd", "../public-backup/x", "nope.txt", "%E0%A4%A"];
for (const p of cases) {
  const r = await safeRead(p);
  console.log(p, "←", r.status, r.status === 200 ? r.body : "");
}

$ node main.js
hello.txt ← 200 ملف عام
../.env ← 403 
%2e%2e/.env ← 403 
/etc/passwd ← 403 
../public-backup/x ← 403 
nope.txt ← 404 
%E0%A4%A ← 400