91 lines
2.6 KiB
Plaintext
91 lines
2.6 KiB
Plaintext
|
== How to fix it in Java I/O API
|
||
|
|
|
||
|
|
=== Code examples
|
||
|
|
|
||
|
|
:canonicalization_function1: java.io.File.getCanonicalFile
|
||
|
|
:canonicalization_function2: java.io.File.getCanonicalPath
|
||
|
|
|
||
|
|
include::../../common/fix/code-rationale.adoc[]
|
||
|
|
|
||
|
|
==== Noncompliant code example
|
||
|
|
|
||
|
|
[source,kotlin,diff-id=1,diff-type=noncompliant]
|
||
|
|
----
|
||
|
|
class Example {
|
||
|
|
companion object {
|
||
|
|
private const val TARGET_DIRECTORY = "/example/directory/"
|
||
|
|
}
|
||
|
|
fun extractEntry(zipFile: ZipFile) {
|
||
|
|
val entries = zipFile.entries()
|
||
|
|
val entry = entries.nextElement()
|
||
|
|
val inputStream = zipFile.getInputStream(entry)
|
||
|
|
val file = File(TARGET_DIRECTORY + entry.name)
|
||
|
|
inputStream.copyTo(file.outputStream())
|
||
|
|
}
|
||
|
|
}
|
||
|
|
----
|
||
|
|
|
||
|
|
==== Compliant solution
|
||
|
|
|
||
|
|
[source,kotlin,diff-id=1,diff-type=compliant]
|
||
|
|
----
|
||
|
|
class Example {
|
||
|
|
companion object {
|
||
|
|
private const val TARGET_DIRECTORY = "/example/directory/"
|
||
|
|
}
|
||
|
|
fun extractEntry(zipFile: ZipFile) {
|
||
|
|
val entries = zipFile.entries()
|
||
|
|
val entry = entries.nextElement()
|
||
|
|
val inputStream = zipFile.getInputStream(entry)
|
||
|
|
val file = File(TARGET_DIRECTORY + entry.name)
|
||
|
|
val canonicalDestinationPath = file.canonicalPath
|
||
|
|
if (canonicalDestinationPath.startsWith(TARGET_DIRECTORY)) {
|
||
|
|
inputStream.copyTo(file.outputStream())
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
----
|
||
|
|
|
||
|
|
=== How does this work?
|
||
|
|
|
||
|
|
include::../../common/fix/how-does-this-work.adoc[]
|
||
|
|
|
||
|
|
=== Pitfalls
|
||
|
|
|
||
|
|
include::../../common/pitfalls/partial-path-traversal.adoc[]
|
||
|
|
|
||
|
|
For example, the following code is vulnerable to partial path injection. Note
|
||
|
|
that the string `targetDirectory` does not end with a path separator:
|
||
|
|
|
||
|
|
|
||
|
|
[source, kotlin]
|
||
|
|
----
|
||
|
|
companion object {
|
||
|
|
private const val targetDirectory = "/Users/John"
|
||
|
|
}
|
||
|
|
|
||
|
|
fun ExtractEntry(zipFile: ZipFile) {
|
||
|
|
val entries = zipFile.entries()
|
||
|
|
val entry = entries.nextElement()
|
||
|
|
val inputStream = zipFile.getInputStream(entry)
|
||
|
|
|
||
|
|
val file = File(entry.name)
|
||
|
|
|
||
|
|
val canonicalDestinationPath = file.canonicalPath
|
||
|
|
if (canonicalDestinationPath.startsWith(targetDirectory)) {
|
||
|
|
Files.copy(inputStream, file.toPath(), StandardCopyOption.REPLACE_EXISTING, LinkOption.NOFOLLOW_LINKS)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
----
|
||
|
|
|
||
|
|
This check can be bypassed because `"/Users/Johnny".startsWith("/Users/John")`
|
||
|
|
returns `true`. Thus, for validation, `"/Users/John"` should actually be
|
||
|
|
`"/Users/John/"`.
|
||
|
|
|
||
|
|
**Warning**: Some functions, such as `.getCanonicalPath`, remove the
|
||
|
|
terminating path separator in their return value. +
|
||
|
|
The validation code should be tested to ensure that it cannot be impacted by this
|
||
|
|
issue.
|
||
|
|
|
||
|
|
https://github.com/aws/aws-sdk-java/security/advisories/GHSA-c28r-hw5m-5gv3[Here is a real-life example of this vulnerability.]
|