Page History

The CERT C Secure Coding Standard

FIO02-C. Canonicalize path names originating from untrusted sources

The CERT C++ Secure Coding Standard

FIO02-CPP. Canonicalize path names originating from untrusted sources

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="25e3c041a993db7e-cecc103d-40e842e4-ab188b75-8ec4ad1ef546ab2a9827837e"><ac:plain-text-body><![CDATA[

[ISO/IEC TR 24772:2010

http://www.aitcnet.org/isai/]

"Authentication Logic Error [XZOPath Traversal [EWR]"

]]></ac:plain-text-body></ac:structured-macro>

MITRE CWE

CWE ID 171, "Cleansing, Canonicalization, and Comparison Errors"

CWE ID 647, "Use of Non-Canonical URL Paths for Authorization Decisions"

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="d9572809c4d3949b-60c31eaf-444b4bf1-8fedbd86-d2d856780df81ea906703cff"><ac:plain-text-body><![CDATA[

[[API 2006

AA. Bibliography#API 06]]

[method getCanonicalPath()

http://java.sun.com/javase/6/docs/api/java/io/File.html#getCanonicalPath()]

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="41d981ac1d389d1d-0d3bdb32-4862418a-b8cfb7f1-0916736cbb9d283c81c626ba"><ac:plain-text-body><![CDATA[

[[Harold 1999

AA. Bibliography#Harold 99]]

]]></ac:plain-text-body></ac:structured-macro>