From a4b614656abf20c9f8e79dc73956ac849433ff30 Mon Sep 17 00:00:00 2001
From: snow <snow@snows-MacBook-Pro-2.local>
Date: Sun, 9 Aug 2026 18:01:24 -0700
Subject: [PATCH] Restrict path traversal level 1 file access

Signed-off-by: snow <snow@snows-MacBook-Pro-2.local>
---
 .../pathTraversal/PathTraversalVulnerability.java           | 3 ++-
 .../vulnerability/pathTraversal/PathTraversalTest.java      | 6 +++---
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/src/main/java/org/sasanlabs/service/vulnerability/pathTraversal/PathTraversalVulnerability.java b/src/main/java/org/sasanlabs/service/vulnerability/pathTraversal/PathTraversalVulnerability.java
index 9eb1c126d..9eccfe7a3 100644
--- a/src/main/java/org/sasanlabs/service/vulnerability/pathTraversal/PathTraversalVulnerability.java
+++ b/src/main/java/org/sasanlabs/service/vulnerability/pathTraversal/PathTraversalVulnerability.java
@@ -79,7 +79,8 @@ private ResponseEntity<GenericVulnerabilityResponseBean<String>> readFile(
     public ResponseEntity<GenericVulnerabilityResponseBean<String>> getVulnerablePayloadLevel1(
             @RequestParam Map<String, String> queryParams) {
         String fileName = queryParams.get(URL_PARAM_KEY);
-        return this.readFile(() -> fileName != null, fileName);
+        return this.readFile(
+                () -> fileName != null && ALLOWED_FILE_NAMES.contains(fileName), fileName);
     }
 
     @AttackVector(
diff --git a/src/test/java/org/sasanlabs/service/vulnerability/pathTraversal/PathTraversalTest.java b/src/test/java/org/sasanlabs/service/vulnerability/pathTraversal/PathTraversalTest.java
index ed779b9cb..8001a1645 100644
--- a/src/test/java/org/sasanlabs/service/vulnerability/pathTraversal/PathTraversalTest.java
+++ b/src/test/java/org/sasanlabs/service/vulnerability/pathTraversal/PathTraversalTest.java
@@ -32,15 +32,15 @@ void testGetVulnerablePayloadLevel1WithNullFileName() {
     }
 
     @Test
-    void testGetVulnerablePayloadLevel1WithWrongFileName() {
+    void testGetVulnerablePayloadLevel1RejectsDisallowedFileName() {
         Map<String, String> queryParams = new HashMap<>();
         queryParams.put("fileName", "../");
         ResponseEntity<GenericVulnerabilityResponseBean<String>> response =
                 pathTraversalVulnerability.getVulnerablePayloadLevel1(queryParams);
         assertEquals(HttpStatus.OK, response.getStatusCode());
         assertNotNull(response.getBody());
-        assertTrue(response.getBody().getIsValid());
-        assertNotNull(response.getBody().getContent());
+        assertFalse(response.getBody().getIsValid());
+        assertNull(response.getBody().getContent());
     }
 
     @Test