Page History

...

Absolute or relative path names may contain file links such as symbolic (soft) links, hard links, short cutsshortcuts, shadows, aliases, and junctions. These file links must be fully resolved before any file validation operations are performed. For example, the final target of a symbolic link called trace might be the path name /home/system/trace. Path names may also contain special file names that make validation difficult:

...

In addition to these specific issues, there are a wide variety of operating system-specific and file system-specific naming conventions that make validation difficult.

The process of canonicalizing Canonicalizing file names makes it easier to validate a path name. More than one path name can refer to a single directory or file. Further, the textual representation of a path name may yield little or no information regarding the directory or file to which it refers. Consequently, all path names must be fully resolved or canonicalized before validation.

Validation may be necessary, for example, when attempting to restrict user access to files within a particular directory or to otherwise make security decisions based on the name of a file name or path name. Frequently, these restrictions can be circumvented by an attacker by exploiting a directory traversal or path equivalence vulnerability. A directory traversal vulnerability allows an I/O operation to escape a specified operating directory. A path equivalence vulnerability occurs when an attacker provides a different but equivalent name for a resource to bypass security checks.

Canonicalization contains an inherent race window between the time the program obtains the canonical path name and the time it opens the file. While the canonical path name is being validated, the file system may have been modified and the canonical path name may no longer reference the original valid file. Fortunately, this race condition can be easily mitigated. The canonical path name can be used to determine whether the referenced file name is in a secure directory (see rule FIO00-J. Do not operate on files in shared directories for more information). If the referenced file is in a secure directory, then, by definition, an attacker cannot tamper with it and cannot exploit the race condition.

This rule recommendation is a specific instance of rule IDS01-J. Normalize strings before validating them.

...

This noncompliant code example accepts a file path as a command-line argument and uses the File.getAbsolutePath() method to obtain the absolute file path. It also uses the isInSecureDir() method defined in rule FIO00-J. Do not operate on files in shared directories to ensure that the file is in a secure directory. However, it neither resolves file links nor eliminates equivalence errors.

...

The application intends to restrict the user from operating on files outside of their his or her home directory. The validate() method attempts to ensure that the path name resides within this directory , but can be easily circumvented. For example, a user can create a link in their the home directory that refers to a directory or file outside of their the home directory. The path name of the link might appear to the validate() method to reside in their the user's home directory and consequently pass validation, but the operation will actually be performed on the final target of the link, which resides outside the intended directory.

Note that File.getAbsolutePath() does resolve symbolic links, aliases, and short cuts shortcuts on Windows and Macintosh platforms. Nevertheless, the Java Language Specification (JLS) lacks any guarantee that this behavior is present on all platforms or that it will continue in future implementations.

...

A comprehensive way of handling this issue is to grant the application the permissions to operate only on files present within the intended directory — the directory—the user's home directory in this example. This compliant solution specifies the absolute path of the program in its security policy file and grants java.io.FilePermission with target ${user.home}/* and actions read and write.

...

This solution requires that the user's home directory is a secure directory, as described in rule FIO00-J. Do not operate on files in shared directories.

Noncompliant Code Example

...

This compliant solution obtains the file name from the untrusted user input, canonicalizes it, and then validates it against a list of benign pathnamespath names. It operates on the specified file only when validation succeeds; that is, only if the file is one of the two valid files file1.txt or file2.txt in /img/java.

...

...