From 6c674bd3a12548ecb53d1c1d17ccff72f5bbc36b Mon Sep 17 00:00:00 2001
From: AmirReza Jamali <amir7jamali.ar@yahoo.com>
Date: Sun, 2 Nov 2025 11:30:17 +0330
Subject: [PATCH] feat: add path traversal protection middleware

Implement security middleware to prevent directory traversal attacks by detecting and blocking requests containing ".." in decoded URL paths
---
 middleware.ts | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)
 create mode 100644 middleware.ts

diff --git a/middleware.ts b/middleware.ts
new file mode 100644
index 0000000..35f1318
--- /dev/null
+++ b/middleware.ts
@@ -0,0 +1,17 @@
+import { NextRequest, NextResponse } from "next/server";
+
+export function middleware(request: NextRequest) {
+  const { pathname } = request.nextUrl;
+
+  const decodedPath = decodeURIComponent(pathname);
+
+  if (decodedPath.includes("..")) {
+    return new NextResponse("Bad Request", { status: 400 });
+  }
+
+  return NextResponse.next();
+}
+
+export const config = {
+  matcher: "/:path*",
+};