Page History

...

• Leading dashes: Leading dashes can cause problems when programs are called with the file name as a parameter because the first character or characters of the file name might be interpreted as an option switch.
• Control characters, such as newlines, carriage returns, and escape: Control characters in a file name can cause unexpected results from shell scripts and in logging.
• Spaces: Spaces can cause problems with scripts and when double quotes aren't are not used to surround the file name.
• Invalid character encodings: Character encodings can make it difficult to perform proper validation of file and path names. (See rule IDS11-J. Eliminate noncharacter code points before validation).
• Name-space separation characters: Including name-space separation characters in a file or path name can cause unexpected and potentially insecure behavior.
• Command interpreters, scripts, and parsers: Some characters have special meaning when processed by a command interpreter, shell, or parser and should consequently be avoided.

As a result of the influence of MS-DOS, file names of the form xxxxxxxx.xxx, where x denotes an alphanumeric character, are generally supported by modern systems. On some platforms, file names are case sensitive; while , and on other platforms, they are case insensitive. VU#439395 is an example of a vulnerability in C resulting from a failure to deal appropriately with case sensitivity issues [VU#439395].

This is a specific instance of rule IDS00-J. Sanitize untrusted data passed across a trust boundary.

...

In the following noncompliant code example, unsafe characters are used as part of a file name.

File f = new File("A\uD8AB");
OutputStream out = new FileOutputStream(f);

A platform is free to define its own mapping of the unsafe characters. For example, when tested on an Ubuntu Linux distribution, this noncompliant code example resulted in the following file name:

A?

Compliant Solution

Use a descriptive file name, containing only the subset of ASCII previously described.

File f = new File("name.ext");
OutputStream out = new FileOutputStream(f);

...

This noncompliant code example creates a file with input from the user without sanitizing the input.

public static void main(String[] args) throws Exception {
  if (args.length < 1) {
    // handleHandle error
  }
  File f = new File(args[0]);
  OutputStream out = new FileOutputStream(f);
  // ...
}

...

In this compliant solution, the program uses a whitelist to reject unsafe file names.

public static void main(String[] args) throws Exception {
  if (args.length < 1) {
    // handleHandle error
  }
  String filename = args[0];

  Pattern pattern = 
    Pattern.compile("[^A-Za-z0-9%&+,.:=_]");
  Matcher matcher = pattern.matcher(filename);
  if (matcher.find()) {
    // filenameFile name contains bad chars,; handle error
  }
  File f = new File(filename);
  OutputStream out = new FileOutputStream(f);
  // ...
}

...

Related Guidelines

Bibliography

            IDS06-J. Exclude user input from format stringsImage Added