Skip to content

Commit a5e7ef4

Browse files
author
Max Schaefer
committed
Revert "Add additional example."
This reverts commit 947b094.
1 parent 143e168 commit a5e7ef4

File tree

3 files changed

+0
-31
lines changed

3 files changed

+0
-31
lines changed

java/ql/src/Security/CWE/CWE-022/TaintedPath.qhelp

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -46,11 +46,6 @@ not contain ".." and starts with the public folder.</p>
4646

4747
<sample src="TaintedPathGood.java" />
4848

49-
<p>Alternatively, if you only want to allow simple filenames without a path component, you can remove all path
50-
separators ("/" or "\") and all ".." sequences from the input before using it to construct a file path.</p>
51-
52-
<sample src="TaintedPathGood2.java" />
53-
5449
</example>
5550
<references>
5651

java/ql/src/Security/CWE/CWE-022/TaintedPathGood2.java

Lines changed: 0 additions & 13 deletions
This file was deleted.

java/ql/test/query-tests/security/CWE-022/semmle/tests/TaintedPath.java

Lines changed: 0 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -32,17 +32,4 @@ public void sendUserFileGood(Socket sock, String user) throws IOException {
3232
}
3333
}
3434
}
35-
36-
public void sendUserFileGood2(Socket sock, String user) throws IOException {
37-
BufferedReader filenameReader = new BufferedReader(new InputStreamReader(sock.getInputStream(), "UTF-8"));
38-
String filename = filenameReader.readLine();
39-
// GOOD: remove all ".." sequences and path separators from the filename
40-
filename = filename.replaceAll("\\.\\.|[/\\\\]", "");
41-
BufferedReader fileReader = new BufferedReader(new FileReader(filename));
42-
String fileLine = fileReader.readLine();
43-
while(fileLine != null) {
44-
sock.getOutputStream().write(fileLine.getBytes());
45-
fileLine = fileReader.readLine();
46-
}
47-
}
4835
}

0 commit comments

Comments
 (0)