The Hacker now strips ../ repeatedly until none remain, but he URL-decodes the name after the stripping, not before. So any URL-encoded ../ passes the stripping, then turns back into characters after decoding.
The same document server, but it strips climb segments repeatedly and then URL-decodes after the strip. The wrong order means an encoded climb segment survives the strip and returns after decoding.
Read /etc/passwd despite the repeated stripping, exploiting that decoding comes after it.
You exploited the strip-before-decode order and read /etc/passwd.
Why the solution worked
The bug is the order of operations: the cleaning happened before decoding, so the encoded input survived and became dangerous after decoding. This is a general rule: always clean and validate on the final form, after every decode, not before. Better yet, do not clean at all — resolve the path and confirm it is inside the allowed folder after full decoding and resolution.
The root cause
Sanitizing then decoding in the wrong order reintroduces what was removed. The rule is that every transform of the input must precede the check, not follow it.
How the code is fixed
Validate on the final form after every decode. The order of operations is the vulnerability here.
Vulnerable code
let name = stripAll(req.query.name); // strips ../ repeatedly
name = decodeURIComponent(name); // ...then decodes — too late
res.send(fs.readFileSync('/var/www/docs/' + name, 'utf8'));
Safe code
// Decode fully first, then resolve, then check containment. No stripping.
const decoded = decodeURIComponent(req.query.name);
const full = path.resolve('/var/www/docs', path.basename(decoded));
if (!full.startsWith('/var/www/docs/')) return res.status(400).end();
res.send(fs.readFileSync(full, 'utf8'));
Impact in the real world
A wrong decode-then-sanitize order has reintroduced path traversal in systems that believed they were protected.
How defenders detect it
Defenders fully decode first, then resolve the path and confirm it is inside the base, and alert on repeated encoding sequences in requests.
