Potential path traversal from request このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。
このルールを試す ID: java-security/path-traversal-file-read
Language: Java
Severity: Error
Category: Security
CWE : 22
Description The filename of the file being opened comes from an input parameter. If an unfiltered parameter is passed to the API, any location on the filesystem can be read.
Learn More Non-Compliant Code Examples class MyClass {
@GET
@Path ( "/images/{image}" )
@Produces ( "images/*" )
public Response getImage ( @javax.ws.rs.PathParam ( "image" ) String image ) {
File file = new File ( "resources/images/" , image ); //Weak point
if ( ! file . exists ()) {
return Response . status ( Status . NOT_FOUND ). build ();
}
return Response . ok (). entity ( new FileInputStream ( file )). build ();
}
}
Compliant Code Examples import org.apache.commons.io.FilenameUtils ;
class MyClass {
@GET
@Path ( "/images/{image}" )
@Produces ( "images/*" )
public Response getImage ( @javax.ws.rs.PathParam ( "image" ) String image ) {
File file = new File ( "resources/images/" , FilenameUtils . getName ( image )); //Fix
if ( ! file . exists ()) {
return Response . status ( Status . NOT_FOUND ). build ();
}
return Response . ok (). entity ( new FileInputStream ( file )). build ();
}
@GET
@Path ( "/images/{image}" )
@Produces ( "images/*" )
public Response getImage ( @javax.ws.rs.PathParam ( "image" ) String image ) {
File file = new File ( "resources/images/" , image2 ); //Weak point
if ( ! file . exists ()) {
return Response . status ( Status . NOT_FOUND ). build ();
}
return Response . ok (). entity ( new FileInputStream ( file )). build ();
}
}
Seamless integrations. Try Datadog Code Analysis
