SEI CERT Oracle Coding Standard for Java

Space shortcuts

Page tree

Versions Compared

Old Version 103

changes.mady.by.user David Svoboda

Saved on

compared with

New Version 104

changes.mady.by.user David Svoboda

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Code Block
bgColor#ccccff
File f = new File("/img/" + args[0]);
String canonicalPath = f.getCanonicalPath();

if (!canonicalPath.equals("/img/java/file1.txt")) {  // Validation
   // Do something
}

if ( &&
    !canonicalPath.equals("/img/java/file2.txt")) {
   // Validation
Invalid file;  // Do somethinghandle error
}

FileInputStream fis = new FileInputStream(f);

...

The CERT C Secure Coding Standard

FIO02-C. Canonicalize path names originating from untrusted sources

The CERT C++ Secure Coding Standard

FIO02-CPP. Canonicalize path names originating from untrusted sources

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="768613a77c09acc1-f03d60c5-4c414296-b908ba69-5db47ee65b472b619c9b55a5"><ac:plain-text-body><![CDATA[

[ISO/IEC TR 24772:2010

http://www.aitcnet.org/isai/]

"Path Traversal [EWR]"

]]></ac:plain-text-body></ac:structured-macro>

MITRE CWE

CWE-171, "Cleansing, Canonicalization, and Comparison Errors"

 

CWE-647, "Use of Non-Canonical URL Paths for Authorization Decisions"

...

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="deaeccf3363a2ace-ee9f7a32-436a400a-897f8b64-262274ceb2f163cb8f665deb"><ac:plain-text-body><![CDATA[

[[API 2006

AA. Bibliography#API 06]]

[method getCanonicalPath()

http://java.sun.com/javase/6/docs/api/java/io/File.html#getCanonicalPath()]

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="763c4d7738460627-af1b51c2-4e9a484f-aec28791-2d3e77169762ffd211a721aa"><ac:plain-text-body><![CDATA[

[[Harold 1999

AA. Bibliography#Harold 99]]

 

]]></ac:plain-text-body></ac:structured-macro>

...