18 lines
519 B
Markdown
18 lines
519 B
Markdown
|
|
||
|
|
## How To Prevent Directory Traversal Attacks
|
||
|
|
|
||
|
|
Avoid passing user-supplied input to filesystem APIs
|
||
|
|
- If this isn't possible, do the following:
|
||
|
|
§ Application should validate user input before processing it by being compared to an allow list
|
||
|
|
§ Append input to base directory and use platform filesystem API to canonicalize the path
|
||
|
|
|
||
|
|
- Sample code that does this:`
|
||
|
|
```
|
||
|
|
File file = new File(BASE_DIRECTORY,
|
||
|
|
userInput);
|
||
|
|
if
|
||
|
|
(file.getCanonicalPath().startsWith(BASE_DIRE
|
||
|
|
CTORY)) {
|
||
|
|
// process file
|
||
|
|
}
|
||
|
|
```
|