SP233270 (Community Member) asked a question.
Project uses normalize() to generated file path based on windows\linux but in VeraCode Static scan report this method used line detected as Directory Traversal(CWE-73) issue as medium flaws.
Common.io 2.6 API Unexpected behavior with normalize(String s) method is not performing validations on path input. "../ " is allowing but somehow return as Null. If the input type is some thing like "../../". with the below lines of code checks can it be remove path DT vulnerabilities issue ? or Regex validation required to fix flaws.
Could somebody please give correct solution.
fileName = "../../etc/passwd";
fileName = FilenameUtils.normalize(fileName); // still holds the same value ("//../foo")
if (fileName != null) {
// file creation path eg: drivec\root\06-03-2020\folder\test
}
else {
throw new CustomerException("Invalid path creation found");
}
.png){kind=logo}
Hi @SP233270 (Community Member),
Thanks for your question.
If I understand correctly, you are referring to the normalize(String) method of the FilenameUtils Class within the Apache Commons library, version 2.6 which is documented here: https://commons.apache.org/proper/commons-io/javadocs/api-1.4/org/apache/commons/io/FilenameUtils.html#normalize(java.lang.String). This method is intended to normalize a path by removing double and single dot path steps.
CWE 73 refers to the external control of the file name or path. As the flaw was identified it suggests an external entity outside the application (such as a user, a configuration file or database) could affect the fileName parameter in your example code.
It was not clear to me from reading your question whether your concern was with the external control flaw (CWE 73) or unexpected behaviour around the normalize(String) method.
We have an article on how to address CWE 73 specifically for Java which you may find useful. You can read it here: https://community.veracode.com/s/article/how-do-i-fix-cwe-73-external-control-of-file-name-or-path-in-java.
I recommend scheduling a consultation with a Veracode Application Security Consultant if you still wish to discuss this specific flaw instance further. You can find details on how to schedule a consultation here: https://help.veracode.com/reader/DGHxSJy3Gn3gtuSIN2jkRQ/7YQTCDJKFEQzL3gL_N90hQ.
Thanks,
Anthony Fielding
Hey , Thanks for quick response.
My concerned was about to fix veracode flaw when normalize() is used? As above lines of check . does it resolve the flaw issue ?
Hello @SP233270 (Community Member),
The use of FilenameUtils.normalize(String) alone will not be sufficient to resolve the flaw.
I recommend you read the article mentioned: https://community.veracode.com/s/article/how-do-i-fix-cwe-73-external-control-of-file-name-or-path-in-java. This will take you through the options available for remediation. Likely you are missing the best practice of validating that the path is what should be expected (e.g. /opt/app/upload-data, and not /etc). This is an approach to reduce the risk of directory traversal attacks. However the article describes a number of steps you can take including the most preferred which would be to hard code the path if possible.
Thanks,
Anthony Fielding
@Anthony Fielding (Veracode)
Here is the Line File dir = new File(FilenameUtils.normalize(conveneFilePath));
As mentioned above !=null else throws Exception so malicious attack not possible right .Correct me If I'm wrong. Pls any suggestion to increase scan report score totally 40 flaws were detected due this normanize() . I would appreciate you thanks in advanced.😊
with Regex : ^[a-zA-Z0-9!@#$%^&{}\\[\\]()_+\\-=,.~'` ]{1,255}$ any change ??
Hi @SP233270 (Community Member),
Given the information you have supplied, simply normalizing the path will not be sufficient to resolve the CWE 73 flaw. Additional checks should be made to ensure the path is rooted in an expected location, as described here: https://community.veracode.com/s/article/how-do-i-fix-cwe-73-external-control-of-file-name-or-path-in-java.
I recommend you schedule a consultation with a Veracode Application Security Consultant. You can find details on how to schedule a consultation here: https://help.veracode.com/reader/DGHxSJy3Gn3gtuSIN2jkRQ/7YQTCDJKFEQzL3gL_N90hQ.
Thanks,
Anthony Fielding