This error detects the situation in which unvalidated or tainted data is used directly in a file or path name for methods that work with system or read/write files. Attackers can use file separator characters and relative path names to read files which they should not access.

Vulnerability and risk

In general, file access and creation on the host system within an application is a security concern. There is a security vulnerability if unchecked user input is used in any part of the file or path string used for execution. Attackers can manipulate files and paths to write data or to access data on the host system. A typical attack could involve manipulating a file name to access the /etc/passwd file from the host system. In general, path injections can compromise the security of the file system on the host server.

Klocwork security vulnerability (SV) checkers identify calls that create potentially dangerous data; these calls are considered unsafe sources. An unsafe source can be any data provided by the user, since the user could be an attacker or has the potential for introducing human error.

Mitigation and prevention

The prevention of path injection attacks from user input can be achieved by validating any and all input from outside the application (user input, file input, system parameters, etc.). Validation should include length and content. Typically only alphanumeric characters are needed (i.e., A-Za-z, 0-9). Any other accepted characters should be escaped. This validation should be done at each source of data such as when each parameter is read from the HTTP request.

Example 1

17     public void processUserProfile(ServletRequest req) throws IOException {
18         // Source of data from HTTP request in servlet
19         String userName = req.getParameter("userName");
20         String profile = profileDir + File.separator + userName;
21         BufferedReader reader = new BufferedReader(new FileReader(profile));
22         try {
23             //...
24         } finally {
25             reader.close();
26         }
27     }

SV.PATH is reported for line 21: 'userName' contains data coming from an HTTP request parameter and might be tainted (line 19). This value is concatenated with a constant string and stored in 'profile' on line 20. On line 21 'profile' is used to access a file in the local filesystem. File and path names can be manipulated to reveal important information or be used to change application behavior.

Security guidelines

Extension

This checker can be extended through the Klocwork knowledge base. See Tuning Java analysis for more information.