From e2f04d7d783d0140b95bd698f36a7511994fd170 Mon Sep 17 00:00:00 2001
From: Jules <jules@example.com>
Date: Wed, 15 Jul 2026 17:13:36 +0000
Subject: [PATCH] Fix path traversal vulnerability in storage service content
 endpoint

Reordered path resolution so that validation occurs after joining user input, preventing traversal attacks on the /content endpoint.
---
 my-portfolio/server/storage-service/index.js | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/my-portfolio/server/storage-service/index.js b/my-portfolio/server/storage-service/index.js
index bc36b50..80081f6 100644
--- a/my-portfolio/server/storage-service/index.js
+++ b/my-portfolio/server/storage-service/index.js
@@ -374,7 +374,8 @@ app.get('/content/:filename', (req, res) => {
     let filePath;
     const subPath = req.query.path || '';
     try {
-        filePath = path.join(safeResolve(subPath), req.params.filename);
+        const rawPath = path.join(subPath, req.params.filename);
+        filePath = safeResolve(rawPath);
     } catch (e) {
         return res.status(400).send(e.message);
     }