A file name printed back to the user can be used by an attacker to predict other file names, for example to predict the next name of a temporary file. This information can then be used for unauthorized access, such as viewing other users' secret data. It also releases the directory structure, which allows an attacker to create a path manipulation attack if the code has a path injection vulnerability. Also called "path disclosure" vulnerability.

Klocwork security vulnerability (SV) checkers identify calls that create potentially dangerous data; these calls are considered unsafe sources. An unsafe source can be any data provided by the user, since the user could be an attacker or has the potential for introducing human error.

Mitigation and prevention

Never print the full or temporary file name back to a user. For debug purposes use the server log, not the user's screen.

Example 1

12     protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
13         // use user Name as the unique prefix
14         String debug = req.getParameter("debug");
15         File file = File.createTempFile("tempfile", ".tmp");
16         if (debug.equals("true")) {
17             resp.getOutputStream().print("Using " + file.toString());
18         }
19         // ...
20         file.delete();
21     }

SV.IL.FILE is reported for line 17: leaking name of temporary file 'file' created on line 15. This is sensitive information that can be used by an attacker to predict the location of other files to achieve unauthorized access.

Security guidelines

Extension

This checker can be extended through the Klocwork knowledge base. See Tuning Java analysis for more information.