id: http-block-path-traversal
name: Block path traversal
protocol: http
description: Stops common path traversal probes in path and query.
category: http
family: web-hardening
tags:
- path-traversal
- web
- block
action: block
summary: Stops common path traversal probes in path and query.
behavior: Logs the matched traversal token and immediately drops the client connection
  before the request reaches the upstream service.
source_url: https://docs.mitmproxy.org/stable/addons/examples/
code: |
  import logging
  from urllib.parse import unquote

  from mitmproxy import http

  TRAVERSAL_MARKERS = (
      "../",
      "..\\",
      "%2e%2e",
      "%252e%252e",
      "..%2f",
      "..%5c",
  )


  def request(flow: http.HTTPFlow) -> None:
      raw_target = (
          f"{flow.request.path}?{flow.request.query}"
          if flow.request.query
          else flow.request.path
      )
      normalized = unquote(unquote(raw_target)).lower()
      for marker in TRAVERSAL_MARKERS:
          if marker in normalized:
              logging.warning(
                  "[http-block-path-traversal] blocked %s %s from %s",
                  flow.request.method,
                  flow.request.pretty_url,
                  flow.client_conn.peername,
              )
              flow.kill()
              return