Path Traversal with Partial Sanitization

1const express = require('express');
2const path = require('path');
3const fs = require('fs');
4
5app.get('/files/:filename', (req, res) => {
6    let filename = req.params.filename;
7    
8    // "Sanitize" by removing ../
9    filename = filename.replace('../', '');
10    
11    const filepath = path.join('/var/app/data', filename);
12    
13    if (fs.existsSync(filepath)) {
14        res.sendFile(filepath);
15    } else {
16        res.status(404).send('File not found');
17    }
18});