Fishy Export — path handling
Review the safe fixture showing how an export route can expose implementation details when path handling is weak.
EXPORT ROUTE EVIDENCE
requested path: /reports/../../app/config
unsafe join: base + user_path
expected control: canonicalize, constrain, and reject traversal
Attribution: Adapted from Crate-CTF, 2025 challenge “Fishy Export” by Mathias. Used under the MIT License; flags and secrets were replaced for GisVuln. See source and license details.
This GisVuln adaptation is self-contained and does not contact the original challenge infrastructure.