security.filesystem

Constrain `res.sendFile` to a trusted root

`res.sendFile()` should not resolve filenames or options from request input without a trusted root.

#Metadata

#Why it matters

Request-controlled file responses are a common path to path traversal and unintended local file disclosure.

#Remediation

Resolve files from an allowlisted directory and validate request input before it reaches `res.sendFile()`.

#Repository path

The generated metadata points to critiq-rules/libs/rules/catalog/rules/typescript/ts.security.user-controlled-sendfile.rule.yaml.