From f0db71d524f092257e43207db39644564796602f Mon Sep 17 00:00:00 2001 From: Loris S <91723853+loris-s-sonarsource@users.noreply.github.com> Date: Thu, 30 Nov 2023 19:07:23 +0100 Subject: [PATCH] Modify S2083(java): Improve the compliant sample (#3472) --- rules/S2083/java/how-to-fix-it/java-se.adoc | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/rules/S2083/java/how-to-fix-it/java-se.adoc b/rules/S2083/java/how-to-fix-it/java-se.adoc index 8efa58f7a37..ac8607bc2b1 100644 --- a/rules/S2083/java/how-to-fix-it/java-se.adoc +++ b/rules/S2083/java/how-to-fix-it/java-se.adoc @@ -31,15 +31,15 @@ public class ExampleController @Controller public class ExampleController { - static private String targetDirectory = "/path/to/target/directory/"; + private static String targetDirectory = "/path/to/target/directory/"; + private static Path targetPath = new File(targetDirectory).toPath().normalize(); @GetMapping(value = "/delete") public void delete(@RequestParam("filename") String filename) throws IOException { - File file = new File(targetDirectory + filename); - String canonicalDestinationPath = file.getCanonicalPath(); + File file = new File(targetPath + filename); - if (!canonicalDestinationPath.startsWith(targetDirectory)) { + if (!file.toPath().normalize().startsWith(targetPath)) { throw new IOException("Entry is outside of the target directory"); }