From 73e3fada44be2685ffe7e0cd5eda6628b8601caa Mon Sep 17 00:00:00 2001 From: erik-krogh Date: Thu, 25 Jan 2024 12:14:10 +0100 Subject: [PATCH] add missing

--- java/ql/src/Security/CWE/CWE-022/TaintedPath.qhelp | 1 + 1 file changed, 1 insertion(+) diff --git a/java/ql/src/Security/CWE/CWE-022/TaintedPath.qhelp b/java/ql/src/Security/CWE/CWE-022/TaintedPath.qhelp index 0e854370425f..8fe3dbe3f563 100644 --- a/java/ql/src/Security/CWE/CWE-022/TaintedPath.qhelp +++ b/java/ql/src/Security/CWE/CWE-022/TaintedPath.qhelp @@ -18,6 +18,7 @@ unexpected special characters such as "..". Such a path could point anywhere on

Common validation methods include checking that the normalized path is relative and does not contain any ".." components, or checking that the path is contained within a safe folder. The method you should use depends on how the path is used in the application, and whether the path should be a single path component. +

If the path should be a single path component (such as a file name), you can check for the existence of any path separators ("/" or "\"), or ".." sequences in the input, and reject the input if any are found.