HSoni202357 (Community Member) asked a question.
External Control of File Name or Path (CWE ID
73)(2 flaws)
73)(2 flaws)
public IActionResult RemoveImage(string ImgPath)
{
if (!string.IsNullOrEmpty( ImgPath ))
{
Regex imageExtensionRegex = new Regex( @"^[\w-_. ]+\.(jpg|jpeg|png)$" );
if (imageExtensionRegex.IsMatch( ImgPath ) && ImgPath.StartsWith( WebHostEnvironment.WebRootPath ))
{
if (System.IO.File.Exists( ImgPath ))
{
System.IO.File.Delete( ImgPath );
}
return Json( new
{
result = "success"
} );
}
}
In The Above method i have applied validation using regex , but the flaw is not getting fixed,
Please suggest
.png){kind=logo}
Hi @HSoni202357 (Community Member) I was informed by the team that you can visit https://community.veracode.com/s/article/how-do-i-fix-cwe-73-external-control-of-file-name-or-path-in-java for answers on your inquiry. Look for the part that begins: "This does not automatically close the flaw"