CWE-36: Absolute Path Traversal

In the example below, the path to a dictionary file is read from a system property and used to initialize a File object.

However, the path is not validated or modified to prevent it from containing relative or absolute path sequences before creating the File object. This allows anyone who can control the system property to determine what file is used. Ideally, the path should be resolved relative to some kind of application or user home directory.

String filename = System.getProperty("com.domain.application.dictionaryFile");File dictionaryFile = new File(filename);

This script intends to read a user-supplied file from the current directory. The user inputs the relative path to the file and the script uses Python's os.path.join() function to combine the path to the current working directory with the provided path to the specified file. This results in an absolute path to the desired file. If the file does not exist when the script attempts to read it, an error is printed to the user.

However, if the user supplies an absolute path, the os.path.join() function will discard the path to the current working directory and use only the absolute path provided. For example, if the current working directory is /home/user/documents, but the user inputs /etc/passwd, os.path.join() will use only /etc/passwd, as it is considered an absolute path. In the above scenario, this would cause the script to access and read the /etc/passwd file.

import os                   import sys                   def main():                                            filename = sys.argv[1]                      path = os.path.join(os.getcwd(), filename)                      try:                                                  with open(path, 'r') as f:                                                        file_data = f.read()                                                                           except FileNotFoundError as e:                                                  print("Error - file not found")                                                                  main()

This script intends to read a user-supplied file from the current directory. The user inputs the relative path to the file and the script uses Python's os.path.join() function to combine the path to the current working directory with the provided path to the specified file. This results in an absolute path to the desired file. If the file does not exist when the script attempts to read it, an error is printed to the user.

However, if the user supplies an absolute path, the os.path.join() function will discard the path to the current working directory and use only the absolute path provided. For example, if the current working directory is /home/user/documents, but the user inputs /etc/passwd, os.path.join() will use only /etc/passwd, as it is considered an absolute path. In the above scenario, this would cause the script to access and read the /etc/passwd file.

import os                      import sys                      def main():                                              filename = sys.argv[1]                        path = os.path.normpath(f"{os.getcwd()}{os.sep}{filename}") 		       if path.startswith("/home/cwe/documents/"): 		        			 try: 			                             with open(path, 'r') as f:                                                          file_data = f.read()                             			  			 except FileNotFoundError as e: 			                             print("Error - file not found") 			                          		                           main()