Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
The File System in Node.js: fs/promises, path, Buffer and File Handling Pitfalls
On a Node.js server, file work is done with node:fs/promises, but the real job is handling encodings correctly, writing files atomically and keeping user-supplied paths inside the root folder. With real output: an 8-character Turkish title taking 11 bytes, Turkish characters breaking at chunk boundaries, the BOM in Excel's CSV, 61 of 62 reads seeing a half-written file with writeFile, lost updates, the startsWith trap, and the Permission Model disabling fsync.
OWASP A01: Broken Access Control (2) — Path Traversal, CORS and SSRF
A download endpoint that takes a file name from the client, a CORS policy that echoes back every origin and cover-download code that requests whatever URL it is given. We examine the three vulnerable patterns and close them with a canonical path check, a policy that lists origins one by one and an HttpClient with an allowlist, disabled redirects and an IP check in ConnectCallback, then watch the fixed code reject bad input in the lab.