{"id":45706769,"title":"Show HN: Path-security – Comprehensive path validation with 62 attack vectors","points":2,"user":"redasgard","time":1761424564,"time_ago":"8 hours ago","type":"link","content":"

Hi HN! Author here.

TL;DR: Comprehensive path validation protecting against 62+ attack vectors including encoding attacks, Unicode tricks, and Windows-specific exploits. 95.81% test coverage, battle-tested in production.

The motivation: We built a blockchain security platform that handles untrusted code repositories. Standard path validation wasn't enough - we kept discovering new attack vectors:

- URL encoding: %2e%2e%2f → ../\n- Double encoding: %252e%252e%252f → %2e%2e%2f → ../ \n- UTF-8 overlong: %c0%ae (invalid but sometimes accepted)\n- Unicode homoglyphs: ․․/ (using U+2024)\n- Windows NTFS streams: file.txt::$DATA\n- Trailing dots/spaces (Windows ignores these)\n- And 50+ more patterns

After 6 months of production hardening, we extracted this into a standalone library. Every attack we've seen is tested (21 tests, 62+ patterns).

*Stats*:\n- 62+ attack patterns covered\n- 95.81% test coverage\n- Zero dependencies (only anyhow)\n- Cross-platform compatibility\n- MIT/Apache-2.0 licensed

*Links*:\n- Crates.io: https://crates.io/crates/path-security\n- GitHub: https://github.com/redasgard/path-security\n- Docs: https://docs.rs/path-security

Perfect for web file uploads, archive extraction, git operations, and any application handling user-provided paths.

Feedback very welcome!","url":"https://github.com/redasgard/path-security","domain":"github.com","comments":[],"comments_count":0}