Dot Dot Slash Attacks

In one of my applications there was recently a security audit and directory traversal came up. In one package I'm using, one method allows you to download a file from a specified path, however this path is exposed in a GET request.

So, you can append ../../../../../ until you reach the root of the server, which is awful.

A code example

return response()->download("../.env");

As there is no protection in place, this will break out of the public folder and actually download the .env file.

I've read this could be avoided by using realpath() and doing some comparison but my attempts have been unsuccessful.

        $query_string = $validated_data['q'];

        $laravel_root = base_path();

        $user_real_path = realpath($query_string);

        dd($user_real_path);

        if ($user_real_path === false || strpos($user_real_path, $laravel_root) !== 0) {
            dd('traversal');
        } else {
            dd('!traversal');
        }