🐛 bug: align upload root config

app.go

@@ -15,6 +15,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"io/fs"
 	"net"
 	"net/http"
 	"net/http/httputil"
@@ -159,6 +160,22 @@ type Config struct { //nolint:govet // Aligning the struct fields is not necessa
 	// Default: 4 * 1024 * 1024
 	BodyLimit int `json:"body_limit"`
 
+	// RootDir defines the directory where files can be persisted using SaveFile and SaveFileToStorage.
+	// The path must be relative to the current working directory or an absolute path on the host system.
+	//
+	// Default: "."
+	RootDir string `json:"root_dir"`
+
+	// RootFS provides an fs.FS implementation rooted at RootDir used to validate upload targets.
+	//
+	// Default: os.DirFS(RootDir)
+	RootFS fs.FS `json:"-"`
+
+	// RootPerms are the permissions applied when creating RootDir.
+	//
+	// Default: 0o750
+	RootPerms fs.FileMode `json:"root_perms"`
+
 	// Maximum number of concurrent connections.
 	//
 	// Default: 256 * 1024
@@ -562,6 +579,12 @@ func New(config ...Config) *App {
 	if app.config.BodyLimit <= 0 {
 		app.config.BodyLimit = DefaultBodyLimit
 	}
+	if app.config.RootDir == "" {
+		app.config.RootDir = "."
+	}
+	if app.config.RootPerms == 0 {
+		app.config.RootPerms = 0o750
+	}
 	if app.config.Concurrency <= 0 {
 		app.config.Concurrency = DefaultConcurrency
 	}

ctx.go

@@ -7,10 +7,16 @@ package fiber
 import (
 	"context"
 	"crypto/tls"
+	"errors"
 	"fmt"
 	"io"
+	"io/fs"
 	"maps"
 	"mime/multipart"
+	"os"
+	pathpkg "path"
+	"path/filepath"
+	"slices"
 	"strconv"
 	"strings"
 	"time"
@@ -453,12 +459,26 @@ func (c *DefaultCtx) IsPreflight() bool {
 }
 
 // SaveFile saves any multipart file to disk.
-func (*DefaultCtx) SaveFile(fileheader *multipart.FileHeader, path string) error {
-	return fasthttp.SaveMultipartFile(fileheader, path)
+func (c *DefaultCtx) SaveFile(fileheader *multipart.FileHeader, path string) error {
+	_, absolutePath, err := resolveUploadPath(c.app, path)
+	if err != nil {
+		return err
+	}
+
+	if err := os.MkdirAll(filepath.Dir(absolutePath), c.app.config.RootPerms); err != nil {
+		return fmt.Errorf("failed to prepare upload path: %w", err)
+	}
+
+	return fasthttp.SaveMultipartFile(fileheader, absolutePath)
 }
 
 // SaveFileToStorage saves any multipart file to an external storage system.
 func (c *DefaultCtx) SaveFileToStorage(fileheader *multipart.FileHeader, path string, storage Storage) error {
+	safePath, _, err := resolveUploadPath(c.app, path)
+	if err != nil {
+		return err
+	}
+
 	file, err := fileheader.Open()
 	if err != nil {
 		return fmt.Errorf("failed to open: %w", err)
@@ -488,13 +508,158 @@ func (c *DefaultCtx) SaveFileToStorage(fileheader *multipart.FileHeader, path st
 
 	data := append([]byte(nil), buf.Bytes()...)
 
-	if err := storage.SetWithContext(c.Context(), path, data, 0); err != nil {
+	if err := storage.SetWithContext(c.Context(), safePath, data, 0); err != nil {
 		return fmt.Errorf("failed to store: %w", err)
 	}
 
 	return nil
 }
 
+//nolint:nonamedreturns // names clarify path handling through normalization and validation
+func resolveUploadPath(app *App, path string) (normalizedPath, absolutePath string, err error) {
+	if app == nil {
+		return "", "", fmt.Errorf("invalid upload root: %w", errors.New("app is nil"))
+	}
+
+	uploadRoot, err := getRootDir(app)
+	if err != nil {
+		return "", "", err
+	}
+
+	uploadFS := app.config.RootFS
+	if uploadFS == nil {
+		uploadFS = os.DirFS(uploadRoot)
+	}
+
+	normalizedPath, err = sanitizeUploadPath(path, uploadFS)
+	if err != nil {
+		return "", "", err
+	}
+
+	relativePath := filepath.FromSlash(normalizedPath)
+	absolutePath = filepath.Join(uploadRoot, relativePath)
+	if !isWithinRoot(uploadRoot, absolutePath) {
+		return "", "", errUploadOutsideRoot
+	}
+
+	return normalizedPath, absolutePath, nil
+}
+
+func getRootDir(app *App) (string, error) {
+	root := app.config.RootDir
+	if root == "" {
+		root = "."
+	}
+
+	perms := app.config.RootPerms
+	if perms == 0 {
+		perms = 0o750
+	}
+
+	absoluteRoot, err := filepath.Abs(root)
+	if err != nil {
+		return "", fmt.Errorf("invalid upload root: %w", err)
+	}
+
+	if err = os.MkdirAll(absoluteRoot, perms); err != nil {
+		return "", fmt.Errorf("invalid upload root: %w", err)
+	}
+
+	resolvedRoot, err := filepath.EvalSymlinks(absoluteRoot)
+	if err == nil {
+		absoluteRoot = resolvedRoot
+	} else if !errors.Is(err, fs.ErrNotExist) {
+		return "", fmt.Errorf("invalid upload root: %w", err)
+	}
+
+	info, err := os.Stat(absoluteRoot)
+	if err != nil {
+		return "", fmt.Errorf("invalid upload root: %w", err)
+	}
+
+	if !info.IsDir() {
+		return "", fmt.Errorf("invalid upload root: %s is not a directory", absoluteRoot)
+	}
+
+	return absoluteRoot, nil
+}
+
+func sanitizeUploadPath(path string, uploadFS fs.FS) (string, error) {
+	if filepath.IsAbs(path) {
+		return "", errUploadAbsolute
+	}
+
+	rawNormalized := strings.ReplaceAll(path, "\\", "/")
+	if containsParentDir(rawNormalized) {
+		return "", errUploadTraversal
+	}
+
+	normalized := pathpkg.Clean(rawNormalized)
+	normalized = utils.TrimLeft(normalized, '/')
+	if normalized == "" || normalized == "." {
+		return "", errUploadTraversal
+	}
+
+	if !fs.ValidPath(normalized) {
+		return "", errUploadTraversal
+	}
+
+	if err := rejectSymlinkTraversal(uploadFS, normalized); err != nil {
+		return "", err
+	}
+
+	return normalized, nil
+}
+
+func rejectSymlinkTraversal(uploadFS fs.FS, normalized string) error {
+	if uploadFS == nil {
+		return nil
+	}
+
+	parts := strings.Split(normalized, "/")
+	current := "."
+
+	for i, part := range parts {
+		next := part
+		if current != "." {
+			next = pathpkg.Join(current, part)
+		}
+
+		info, err := fs.Stat(uploadFS, next)
+		if err != nil {
+			if errors.Is(err, fs.ErrNotExist) {
+				return nil
+			}
+			return fmt.Errorf("invalid upload path: %w", err)
+		}
+
+		if info.Mode()&fs.ModeSymlink != 0 {
+			return errUploadSymlinkPath
+		}
+
+		if i < len(parts)-1 && !info.IsDir() {
+			return errUploadTraversal
+		}
+
+		current = next
+	}
+
+	return nil
+}
+
+func containsParentDir(p string) bool {
+	return slices.Contains(strings.Split(p, "/"), "..")
+}
+
+func isWithinRoot(root, target string) bool {
+	rel, err := filepath.Rel(root, target)
+	if err != nil {
+		return false
+	}
+
+	return rel != ".." && !strings.HasPrefix(rel, "../") && rel != "..\\" && !strings.HasPrefix(rel, "..\\")
+}
+
 // Secure returns whether a secure connection was established.
 func (c *DefaultCtx) Secure() bool {
 	return c.Protocol() == schemeHTTPS

ctx_test.go

@@ -17,6 +17,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"io/fs"
 	"math"
 	"mime/multipart"
 	"net"
@@ -3910,25 +3911,18 @@ func Test_Ctx_RouteNormalized(t *testing.T) {
 func Test_Ctx_SaveFile(t *testing.T) {
 	// TODO We should clean this up
 	t.Parallel()
-	app := New()
+	uploadRoot := t.TempDir()
+	app := New(Config{RootDir: uploadRoot})
 
 	app.Post("/test", func(c Ctx) error {
 		fh, err := c.Req().FormFile("file")
 		require.NoError(t, err)
 
-		tempFile, err := os.CreateTemp(os.TempDir(), "test-")
-		require.NoError(t, err)
-
-		defer func(file *os.File) {
-			closeErr := file.Close()
-			require.NoError(t, closeErr)
-			closeErr = os.Remove(file.Name())
-			require.NoError(t, closeErr)
-		}(tempFile)
-		err = c.SaveFile(fh, tempFile.Name())
+		relativePath := filepath.Join("uploads", "test-upload")
+		err = c.SaveFile(fh, relativePath)
 		require.NoError(t, err)
 
-		bs, err := os.ReadFile(tempFile.Name())
+		bs, err := os.ReadFile(filepath.Join(uploadRoot, relativePath)) //nolint:gosec // upload path validated before use
 		require.NoError(t, err)
 		require.Equal(t, "hello world", string(bs))
 		return nil
@@ -3953,6 +3947,47 @@ func Test_Ctx_SaveFile(t *testing.T) {
 	require.Equal(t, StatusOK, resp.StatusCode, "Status code")
 }
 
+func Test_Ctx_SaveFile_PreventTraversal(t *testing.T) {
+	t.Parallel()
+
+	uploadRoot := t.TempDir()
+	app := New(Config{RootDir: uploadRoot})
+	ctx := app.AcquireCtx(&fasthttp.RequestCtx{})
+
+	t.Cleanup(func() {
+		app.ReleaseCtx(ctx)
+	})
+
+	fileHeader := createMultipartFileHeader(t, "blocked.txt", []byte("forbidden"))
+
+	err := ctx.SaveFile(fileHeader, filepath.Join("..", "escape", "blocked.txt"))
+	require.Error(t, err)
+
+	_, statErr := os.Stat(filepath.Join(uploadRoot, "escape", "blocked.txt"))
+	require.ErrorIs(t, statErr, fs.ErrNotExist)
+}
+
+func Test_Ctx_SaveFile_RejectAbsolute(t *testing.T) {
+	t.Parallel()
+
+	uploadRoot := t.TempDir()
+	app := New(Config{RootDir: uploadRoot})
+	ctx := app.AcquireCtx(&fasthttp.RequestCtx{})
+
+	t.Cleanup(func() {
+		app.ReleaseCtx(ctx)
+	})
+
+	fileHeader := createMultipartFileHeader(t, "blocked.txt", []byte("forbidden"))
+
+	absoluteTarget := filepath.Join(t.TempDir(), "outside.txt")
+	err := ctx.SaveFile(fileHeader, absoluteTarget)
+	require.Error(t, err)
+
+	_, statErr := os.Stat(absoluteTarget)
+	require.ErrorIs(t, statErr, fs.ErrNotExist)
+}
+
 func createMultipartFileHeader(t *testing.T, filename string, data []byte) *multipart.FileHeader {
 	t.Helper()
 
@@ -4022,6 +4057,26 @@ func Test_Ctx_SaveFileToStorage(t *testing.T) {
 	require.Equal(t, StatusOK, resp.StatusCode, "Status code")
 }
 
+func Test_Ctx_SaveFileToStorage_InvalidPath(t *testing.T) {
+	t.Parallel()
+
+	app := New()
+	storage := memory.New()
+	ctx := app.AcquireCtx(&fasthttp.RequestCtx{})
+
+	t.Cleanup(func() {
+		app.ReleaseCtx(ctx)
+	})
+
+	fileHeader := createMultipartFileHeader(t, "blocked.bin", []byte("forbidden"))
+
+	err := ctx.SaveFileToStorage(fileHeader, filepath.Join("..", "escape", "blocked.bin"), storage)
+	require.Error(t, err)
+
+	err = ctx.SaveFileToStorage(fileHeader, filepath.Join(t.TempDir(), "outside.bin"), storage)
+	require.Error(t, err)
+}
+
 func Test_Ctx_SaveFileToStorage_LargeUpload(t *testing.T) {
 	t.Parallel()
 	const (

docs/api/ctx.md

@@ -1398,6 +1398,11 @@ app.Get("/", func(c fiber.Ctx) error {
 ### SaveFile
 
 Method is used to save **any** multipart file to disk.
+Paths are normalized against the configured upload root (`app.Config.RootDir`,
+default `"."`) and validated using `app.Config.RootFS` (defaults to
+`os.DirFS(RootDir)`). Absolute paths, traversal attempts, and symlink escapes
+are rejected before writing. The upload root will be created with
+`app.Config.RootPerms` (default `0o750`) when needed.
 
 ```go title="Signature"
 func (c fiber.Ctx) SaveFile(fh *multipart.FileHeader, path string) error
@@ -1431,6 +1436,11 @@ app.Post("/", func(c fiber.Ctx) error {
 ### SaveFileToStorage
 
 Method is used to save **any** multipart file to an external storage system.
+Paths are normalized against the configured upload root (`app.Config.RootDir`,
+default `"."`) and validated using `app.Config.RootFS` (defaults to
+`os.DirFS(RootDir)`). Absolute paths, traversal attempts, and symlink escapes
+are rejected before writing. The upload root will be created with
+`app.Config.RootPerms` (default `0o750`) when needed.
 
 ```go title="Signature"
 func (c fiber.Ctx) SaveFileToStorage(fileheader *multipart.FileHeader, path string, storage Storage) error

docs/api/fiber.md

@@ -46,6 +46,9 @@ app := fiber.New(fiber.Config{
 |---------------------------------------------------------------------------------------|-----------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------|
 | <Reference id="appname">AppName</Reference>                                           | `string`                                                        | Sets the application name used in logs and the Server header                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | `""`                                                                   |
 | <Reference id="bodylimit">BodyLimit</Reference>                                       | `int`                                                           | Sets the maximum allowed size for a request body. Zero or negative values fall back to the default limit. If the size exceeds the configured limit, it sends `413 - Request Entity Too Large` response.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | `4 * 1024 * 1024`                                                      |
+| <Reference id="rootdir">RootDir</Reference>                                           | `string`                            | Base directory used by `SaveFile` and `SaveFileToStorage` when resolving upload targets. Relative paths are resolved from the process working directory and must remain under this root. | `"."`                                                               |
+| <Reference id="rootfs">RootFS</Reference>                                             | `fs.FS`                             | Filesystem rooted at `RootDir` used to validate upload paths before writing. Defaults to `os.DirFS(RootDir)` when unset. | `os.DirFS(RootDir)`                                                  |
+| <Reference id="rootperms">RootPerms</Reference>                                       | `fs.FileMode`                       | Permissions applied when creating `RootDir` if it does not already exist. | `0o750`                                                              |
 | <Reference id="casesensitive">CaseSensitive</Reference>                               | `bool`                                                          | When enabled, `/Foo` and `/foo` are different routes. When disabled, `/Foo` and `/foo` are treated the same.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | `false`                                                                |
 | <Reference id="colorscheme">ColorScheme</Reference>                                   | [`Colors`](https://github.com/gofiber/fiber/blob/main/color.go) | You can define custom color scheme. They'll be used for startup message, route list and some middlewares.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          | [`DefaultColors`](https://github.com/gofiber/fiber/blob/main/color.go) |
 | <Reference id="compressedfilesuffixes">CompressedFileSuffixes</Reference>             | `map[string]string`                                             | Adds a suffix to the original file name and tries saving the resulting compressed file under the new file name.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | `{"gzip": ".fiber.gz", "br": ".fiber.br", "zstd": ".fiber.zst"}`       |