Skip to content

Commit 0d774a6

Browse files
committed
Fix partial path traversal Java example Again
The original wouldn't compile, and the fix made by github#11899 is sub-optimal. This keeps the entire comparision using the Java `Path` object, which is optimal. Signed-off-by: Jonathan Leitschuh <[email protected]>
1 parent b9d4092 commit 0d774a6

File tree

1 file changed

+6
-0
lines changed

1 file changed

+6
-0
lines changed

java/ql/test/query-tests/security/CWE-023/semmle/tests/PartialPathTraversalTest.java

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -225,6 +225,12 @@ void foo24(File dir, File parent) throws IOException {
225225
}
226226
}
227227

228+
public void doesNotFlagOptimalSafeVersion(File dir, File parent) throws IOException {
229+
if (!dir.toPath().normalize().startsWith(parent.toPath())) { // Safe
230+
throw new IOException("Path traversal attempt: " + dir.getCanonicalPath());
231+
}
232+
}
233+
228234
public void doesNotFlag() {
229235
"hello".startsWith("goodbye");
230236
}

0 commit comments

Comments
 (0)