EasyPro challengeJavaScriptTypeScript
Path Traversal — Reject `..` and Absolute Paths
TypeScriptSecurityAccess Control
The file-download endpoint below serves whatever path the client asks for, relative to an uploads folder.
The bug: a request for ../../etc/passwd (or an absolute path like /etc/passwd) escapes the intended uploads directory entirely, exposing arbitrary files on the server.
Your task: fix solve(userPath) so it returns the path unchanged when it's a safe relative path, or null when it contains .. or starts with /.
Sample tests
Test #1Safe relative path
Input: ["report.txt"]
Output: "report.txt"
Test #2Classic traversal payload
Input: ["../../etc/passwd"]
Output: null
Test #3Absolute path
Input: ["/etc/passwd"]
Output: null