feat(routes): add product packaging leaflet (rerun)

[ogulcan-gurcaglar]

Controlled re-run: tree is byte-identical to the pre-deploy probe branch, so discovery prompts hit the AI cache and only the confirmation stage differs.

[zeropath-ai-staging]

❌ 1 possible security or compliance issue detected. Reviewed everything up to 8942e5c.

The following issues were found:

• Issue 1: Path Traversal

  • Location: routes/productLeaflet.ts:14
  • Score: HIGH (81.0)
  • Description: The newly exposed unauthenticated /rest/products/leaflet endpoint passes the attacker-controlled leaflet query parameter directly to path.join and fs.readFile without constraining it to the intended leaflet directory. A remote anonymous user can supply traversal segments (for example, ?leaflet=../../package.json, adjusted for the process working directory) to read arbitrary files readable by the Node process, including application configuration, source, and potentially secrets, which are then returned in the response.

Evidence: server.ts:572 mounts the handler without authentication, and routes/productLeaflet.ts:13-14 converts req.query.leaflet directly into a filesystem path under ftp/leaflets; path.join normalizes .. segments rather than preventing escape.

• Link to UI: https://staging.branch.zeropath.com/app/issues/bdefb977-587b-4e20-ad56-2203ce16ec9c (Issue 1, id: bdefb977-587b-4e20-ad56-2203ce16ec9c)

Security Overview

• 🔎 Scanned files: 2 changed file(s)
• 🔗 Scan Link: https://staging.branch.zeropath.com/app/repositories/5eea4b94-6a72-403c-af68-60abe8a1d179?scanId=f8d88bf6-dce2-452b-ab81-172f93b798a9&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Enhancement	► routes/productLeaflet.ts     Add new route to serve product leaflets ► server.ts     Register new /rest/products/leaflet route using productLeaflet handler

[zeropath-ai-staging]

Path Traversal in /rest/products/leaflet (routes/productLeaflet.ts) (Severity: HIGH)

An unauthenticated request to /rest/products/leaflet can read arbitrary files. This occurs because leaflet is concatenated directly to a path under ftp/leaflets via path.join and fs.readFile, which allows traversal like ../../package.json, potentially exposing secrets. The route in server.ts:572 is mounted without auth, and routes/productLeaflet.ts:13-14 uses the attacker-controlled parameter to form the filesystem path, resulting in unintended file access.
_{View details in ZeroPath}

Suggested change

	fs.readFile(path.join('ftp/leaflets', String(leaflet)), 'utf8', (error, text) => {
	fs.readFile(path.join('ftp/leaflets', path.basename(String(leaflet))), 'utf8', (error, text) => {

---

_{💬 Reply @ZeroPath false-positive because … or @ZeroPath accepted-risk because … to triage this finding, or ask it any question.}

_{All commands}

[zeropath-ai-staging]

❌ 1 possible security or compliance issue detected. Reviewed everything up to 8942e5c.

The following issues were found:

• Issue 1: Path Traversal

  • Location: routes/productLeaflet.ts:14
  • Score: HIGH (83.0)
  • Description: The new unauthenticated /rest/products/leaflet endpoint uses the attacker-controlled leaflet query parameter directly in path.join before reading the file. A request such as ?leaflet=../../server.ts can escape ftp/leaflets and return arbitrary readable files as text/plain. This exposes server-side source, configuration, secrets, or other sensitive files available to the process.

Evidence: const leaflet = req.query.leaflet ?? 'default.md' obtains request-controlled input, and fs.readFile(path.join('ftp/leaflets', String(leaflet)), ...) performs the filesystem read without canonicalization, allowlisting, or containment validation.

• Link to UI: https://staging.branch.zeropath.com/app/issues/edd4e143-db66-48a3-a94a-8387eef44e3c (Issue 1, id: edd4e143-db66-48a3-a94a-8387eef44e3c)

Security Overview

• 🔎 Scanned files: 2 changed file(s)
• 🔗 Scan Link: https://staging.branch.zeropath.com/app/repositories/76e78572-4c4d-4c18-8702-81b7a5a6273c?scanId=b9dfc343-d49f-4e99-9db1-dd698c19cf4e&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Enhancement	► routes/productLeaflet.ts     Add new route to serve product leaflets ► server.ts     Register new /rest/products/leaflet route using productLeaflet handler

[zeropath-ai-staging]

Path Traversal in /rest/products/leaflet (routes/productLeaflet.ts) (Severity: HIGH)

Path traversal vulnerability: an unauthenticated request to /rest/products/leaflet with a attacker-controlled leaflet parameter leads to arbitrary file reads. The code uses req.query.leaflet directly and feeds it into path.join('ftp/leaflets', leaflet) which causes the server to escape the intended directory and read arbitrary files, resulting in exposure of source, configs, secrets, or other sensitive content.
_{View details in ZeroPath}

Suggested change

	fs.readFile(path.join('ftp/leaflets', String(leaflet)), 'utf8', (error, text) => {
	fs.readFile(path.join('ftp/leaflets', path.basename(String(leaflet))), 'utf8', (error, text) => {

---

_{💬 Reply @ZeroPath false-positive because … or @ZeroPath accepted-risk because … to triage this finding, or ask it any question.}

_{All commands}