Path-security – Comprehensive path validation with 62 attack vectors

Hacker News

Hi HN! Author here. TL;DR: Comprehensive path validation protecting against 62+ attack vectors including encoding attacks, Unicode tricks, and Windows-specific exploits. 95.81% test coverage, battle-tested in production. The motivation: We built a blockchain security platform that handles untrusted code repositories. Standard path validation wasn't enough - we kept discovering new attack vectors: - URL encoding: %2e%2e%2f → ../ - Double encoding: %252e%252e%252f → %2e%2e%2f → ../ - UTF-8 overlong: %c0%ae (invalid but sometimes accepted) - Unicode homoglyphs: ․․/ (using U+2024) - Windows NTFS streams: file.txt::$DATA - Trailing dots/spaces (Windows ignores these) - And 50+ more patterns After 6 months of production hardening, we extracted this into a standalone library. Every attack we've seen is tested (21 tests, 62+ patterns). *Stats*: - 62+ attack patterns covered - 95.81% test coverage - Zero dependencies (only anyhow) - Cross-platform compatibility - MIT/Apache-2.0 licensed *Links*: - Crates.io: https://crates.io/crates/path-security - GitHub: https://github.com/redasgard/path-security - Docs: https://docs.rs/path-security Perfect for web file uploads, archive extraction, git operations, and any application handling user-provided paths. Feedback very welcome!

Visit product View on Hacker NewsOct 25, 2025

Share card

Actual performance

2points

Did not reach leaderboard

Launch Intel predictions

Analyze your own launch →

Indie HackersFits the IH revenue-focused audience · Strong signals: including · Missing: supports, reddit linkedin, podcasting

77%77% predicted probability of success on Indie Hackers, based on ML models trained on real launch data.

best fitHighest predicted score across all platforms for this description.

Product HuntOn track for Day 1 leaderboard · Strong signals: user, new, using · Missing: mac, agents, macos

60%60% predicted probability of success on Product Hunt, based on ML models trained on real launch data.

Hacker NewsStrong engagement from HN community · Strong signals: ide, io, including · Missing: https docs, excited, just released

52%52% predicted probability of success on Hacker News, based on ML models trained on real launch data.

nativeThis product was originally launched on this platform.

AppSumoMay struggle as an AppSumo deal · Strong signals: platform · Missing: plus, intuitive, reviews

46%46% predicted probability of success on AppSumo, based on ML models trained on real launch data.

TrustMRRLess likely to generate early MRR · Strong signals: month · Missing: mobile apps, ios, personal

39%39% predicted probability of success on TrustMRR, based on ML models trained on real launch data.

Acquire.comPre-revenue stage for this audience · Missing: arr, mrr, revenue

15%15% predicted probability of success on Acquire.com, based on ML models trained on real launch data.

BetaListMay not resonate with beta-testers · Missing: web3, chat, crypto

1%1% predicted probability of success on BetaList, based on ML models trained on real launch data.

Incorrect prediction on native model

Similar products

Path Tracing in Go27%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Path Tracing in Go

Hacker News6

Geo_pattern: going on the Go path34%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Geo_pattern: going on the Go path

Hacker News2

Manaslu Circuit Trek9%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

most excellent and off-the-beaten-path

Indie Hackers

Validbot – Comprehensive website validation tool43%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Validbot – Comprehensive website validation tool

Hacker News1

Cylix62%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Cylix – AI-orchestrated XDR for real security validation.

Indie Hackers1ai

JQuery Bezier Curve Path Generator39%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

JQuery Bezier Curve Path Generator

Hacker News3

Rtobj – An example interactive Embree/OptiX/DXR path tracer54%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Rtobj – An example interactive Embree/OptiX/DXR path tracer

Hacker News1

Stepping Stonez31%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Know your Ikigai. Find your path.

Product Hunt+7

Parameter Validation in Javalin (Kotlin)22%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Parameter Validation in Javalin (Kotlin)

Hacker News1

Lemma Derivation/Validation Trees48%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Lemma Derivation/Validation Trees

Hacker News1

Browse all products Analyze your launch