Path Traversal Defense Lab: 2D Floor Stack

This simulator turns a classic secure-coding bug — path (directory) traversal — into a 2D stack of directory floors. Each horizontal band is one directory level; the green band is the application's sandbox root. Send a request path containing ../ segments and a marker climbs or descends the stack floor by floor exactly the way the server's path-resolution logic would. In "naive concatenation" mode the marker is free to wander below the root into the red danger zone and the request still comes back 200 OK — a real information-disclosure bug. Flip to "canonicalize + prefix-check" and the identical request is stopped the instant it would cross the root boundary, with a 403 response. A third preset shows a URL-encoded traversal attempt (%2F for /) decoded before the walk runs, same as a real HTTP server would do. Live readouts track the resolved depth, how many .. segments were used, and a running count of breaches vs. blocked attempts.