Path Traversal (ARCH8103)

Dieser Inhalt ist noch nicht in deiner Sprache verfügbar.

Key kotlin.security.path-traversal · Severity error · Category security · CWE CWE-22

Flags File / Paths.get / FileInputStream built from request, intent or parameter data without normalisation. A template that only splices values the app produced itself (a clock, a UUID, a constant) is not untrusted.

Incorrect

val file = File(uploadDir, request.getParameter("name"))

Correct

val file = File(uploadDir, name).canonicalFile
require(file.startsWith(uploadDir.canonicalFile))

Fix

Canonicalise the path and check it stays under the intended directory.