Preparing access
Checking your lab membership…
Analytics Logs (Path Traversal)
go A logs endpoint reads files by name from a logs directory without path sanitization, allowing traversal.
easy180 ptsfreego
Overview
The Analytics service exposes multiple endpoints that return the contents of log files for debugging:
GET /logs?file=...(infiles/main.go)GET /logs2?file=...(infiles/server.go+files/handlers/logs.go)
An incident revealed arbitrary file reads on the host by abusing .. path traversal.
Your task: identify where traversal occurs and propose a safe join pattern. See files/utils/fs.go for a safe join example (not used by the vulnerable handlers).
handlers/logs.gogo14px