Rule Definition
The software does not properly neutralize special elements that are part of paths or file names used in file system operations. This could allow an attacker to access or modify system files or other files that are critical to the application.

Remediation
Assume all input is malicious. Avoid using inputs. If it is not possible, use an "accept known good" input validation strategy, i.e., use stringent white-lists that limit the character set based on the expected value of the parameter in the request. This will indirectly limit the scope of an attack. Do not rely exclusively on a filtering mechanism that removes potentially dangerous characters. This is equivalent to a blacklist, which may be incomplete (CWE-184). For example, filtering "/" is insufficient protection if the filesystem also supports the use of "\" as a directory separator. Another possible error could occur when the filtering is applied in a way that still produces dangerous data (CWE-182). For example, if "../" sequences are removed from the ".../...//" string in a sequential fashion, two instances of "../" would be removed from the original string, but the remaining characters would still form the "../" string.

Violation Code Sample

The following code uses input from a configuration file to determine which file to open and echo back to the user. If the program runs with privileges and malicious users can change the configuration file, they can use the program to read any file on the system that ends with the extension .txt.

String file; // value given by an API request
fis = new FileInputStream(file + ".txt");
amt = fis.read(arr);
out.println(arr);

Fixed Code Sample

String file; // constant value
fis = new FileInputStream(file + ".txt");
amt = fis.read(arr);
out.println(arr);

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') https://cwe.mitre.org/data/definitions/22.html CWE-73: External Control of File Name or Path https://cwe.mitre.org/data/definitions/73.html CWE-434: Unrestricted Upload of File with Dangerous Type https://cwe.mitre.org/data/definitions/434.html Open Web Application Security Project (OWASP) https://www.owasp.org/index.php/Top_10-2017_A5-Broken_Access_Control CISQ rule: ASCSM-CWE-078.