SV.PATH.INJ

File injection

This error occurs when unvalidated user data is used as part of a file name which is created or written.

As of release 2023.2, this checker supports Jakarta EE.

Vulnerability and risk

In conjunction with data injection, this situation can allow injection of data into arbitrary files, for example, /etc/passwd. On its own, file injection can be used to create files and directories with which the attacker's chosen names can be used in future attacks. For example, the attacker could force an application to create a file with sensitive information on a world-readable location.

Klocwork security vulnerability (SV) checkers identify calls that create potentially dangerous data; these calls are considered unsafe sources. An unsafe source can be any data provided by the user, since the user could be an attacker or has the potential for introducing human error.

Mitigation and prevention

Validate all user data for allowable lexical values and size. For example, if usernames have to be part of the directory structure, check them for size and content on alphanumeric characters.

Vulnerable code example 1

Copy

1
2
3
4
5
6
7
8
9
10
11
12
     import javax.servlet.http.*;
     protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
         String name = req.getParameter("userName");
         File userDir = new File("userFiles", name);
         File profile = new File(userDir, "profile");
         FileOutputStream stream = new FileOutputStream(profile);
         try {
             createFileWithSensitiveInformation(stream);
         } finally {
             stream.close();
         }
     }

Klocwork reports an SV.PATH.INJ defect for line 6, indicating: 'name' contains data coming from an HTTP request parameter and might be tainted (line 3). This value is used to create file 'profile' on line 5 which is used on line 6 to create a FileOutputStream. This can be used to inject information into an arbitrary file in the server file system.

Vulnerable code example 2

Copy

1
2
3
4
5
6
7
8
9
10
11
12
     import jakarta.servlet.http.*;
     protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
         String name = req.getParameter("userName");
         File userDir = new File("userFiles", name);
         File profile = new File(userDir, "profile");
         FileOutputStream stream = new FileOutputStream(profile);
         try {
             createFileWithSensitiveInformation(stream);
         } finally {
             stream.close();
         }
     }

Klocwork reports an SV.PATH.INJ defect for line 6, indicating: 'name' contains data coming from an HTTP request parameter and might be tainted (line 3). This value is used to create file 'profile' on line 5 which is used on line 6 to create a FileOutputStream. This can be used to inject information into an arbitrary file in the server file system.

External guidance

Security training

Application security training materials provided by Secure Code Warrior.

Path Traversal Training Video - Test your skills with a training example

Extension

This checker can be extended through the Klocwork knowledge base. See Tuning Java analysis for more information.