Page History

The CERT C Secure Coding Standard

FIO02-C. Canonicalize path names originating from untrusted sources

The CERT C++ Secure Coding Standard

FIO02-CPP. Canonicalize path names originating from untrusted sources

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="7235386fd2540ab2-b9835246-42d04d17-ac91ad3d-8992dbf1f1670e9a0e52e1dc"><ac:plain-text-body><![CDATA[

[ISO/IEC TR 24772:2010

http://www.aitcnet.org/isai/]

Path Traversal [EWR]

]]></ac:plain-text-body></ac:structured-macro>

MITRE CWE

CWE-171. Cleansing, canonicalization, and comparison errors

CWE-647. Use of non-canonical URL paths for authorization decisions

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="6dbcaf318bf55d33-d315c5bc-4bca4585-b99897f2-0fca5915f595ef89b89f8b0f"><ac:plain-text-body><![CDATA[

[[API 2006

AA. Bibliography#API References#API 06]]

[method getCanonicalPath()

http://java.sun.com/javase/6/docs/api/java/io/File.html#getCanonicalPath()]

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="65dbe058ad35ba56-420d6f67-4a4542e5-bbff8243-d3ef2bee54baafae09cfc1bd"><ac:plain-text-body><![CDATA[

[[Harold 1999

AA. Bibliography#Harold References#Harold 99]]

]]></ac:plain-text-body></ac:structured-macro>