SV.PATH

Path and file name injection

This error detects the situation in which unvalidated or tainted data is used directly in a file or path name for methods that work with system or read/write files. Attackers can use file separator characters and relative path names to read files which they should not access.

As of release 2023.2, this checker supports Jakarta EE.

Vulnerability and risk

In general, file access and creation on the host system within an application is a security concern. There is a security vulnerability if unchecked user input is used in any part of the file or path string used for execution. Attackers can manipulate files and paths to write data or to access data on the host system. A typical attack could involve manipulating a file name to access the /etc/passwd file from the host system. In general, path injections can compromise the security of the file system on the host server.

Klocwork security vulnerability (SV) checkers identify calls that create potentially dangerous data; these calls are considered unsafe sources. An unsafe source can be any data provided by the user, since the user could be an attacker or has the potential for introducing human error.

Mitigation and prevention

The prevention of path injection attacks from user input can be achieved by validating any and all input from outside the application (user input, file input, system parameters, etc.). Validation should include length and content. Typically only alphanumeric characters are needed (i.e., A-Za-z, 0-9). Any other accepted characters should be escaped. This validation should be done at each source of data such as when each parameter is read from the HTTP request.

Vulnerable code example 1

Copy

1
2
3
4
5
6
7
8
9
10
11
12
     import javax.servlet.http.*;
     public void processUserProfile(ServletRequest req) throws IOException {
         // Source of data from HTTP request in servlet
         String userName = req.getParameter("userName");
         String profile = profileDir + File.separator + userName;
         BufferedReader reader = new BufferedReader(new FileReader(profile));
         try {
             //...
         } finally {
             reader.close();
         }
     }

Klocwork reports an SV.PATH defect on line 6, indicating: 'userName' contains data coming from an HTTP request parameter and might be tainted (line 5). This value is concatenated with a constant string and stored in 'profile' on line 6. On line 7 'profile' is used to access a file in the local file system. File and path names can be manipulated to reveal important information or be used to change application behavior.

Vulnerable code example 2

Copy

1
2
3
4
5
6
7
8
9
10
11
12
     import jakarta.servlet.http.*;
     public void processUserProfile(ServletRequest req) throws IOException {
         // Source of data from HTTP request in servlet
         String userName = req.getParameter("userName");
         String profile = profileDir + File.separator + userName;
         BufferedReader reader = new BufferedReader(new FileReader(profile));
         try {
             //...
         } finally {
             reader.close();
         }
     }

Klocwork reports an SV.PATH defect on line 6, indicating: 'userName' contains data coming from an HTTP request parameter and might be tainted (line 5). This value is concatenated with a constant string and stored in 'profile' on line 6. On line 7 'profile' is used to access a file in the local file system. File and path names can be manipulated to reveal important information or be used to change application behavior.

External guidance

Security training

Application security training materials provided by Secure Code Warrior.

Path Traversal Training Video - Test your skills with a training example

Extension

This checker can be extended through the Klocwork knowledge base. See Tuning Java analysis for more information.