Coverity issues for Filesystem path, filename, or URI manipulation in java

Question

I am working with some coverity issues in my source code . Here i am using the code like ,

    filePath = properties.getProperty("DO.LIB.LOC");
    String fileName = (String) request.getParameter("read");
    filePath += "/" + fileName;
    downloadResultSet.flushFile(filePath, response, 
    fileName.substring(fileName.lastIndexOf(".") + 1));

In my coveiry scanned tool found an error like "CID 38762 (#1 of 2): Filesystem path, filename, or URI manipulation (PATH_MANIPULATION) 2. sink: Constructing a path or URI using the tainted value filePath. This may allow an attacker to access, modify, or test the existence of critical or sensitive files. The value is used unsafely in bytecode, which cannot be displayed."

File Path defined in an external property file and file name takes from request .

I am using the same code in different java file for file upload ,delete ,download functionalities . How can i avoid these kind of vulnerabilities from my code . Can any one help me on this ?

Possible duplicate of [How to fix "Path Manipulation Vulnerability" in some Java Code?](https://stackoverflow.com/questions/12690652/how-to-fix-path-manipulation-vulnerability-in-some-java-code) — Catchwa, Jun 05 '17 at 23:21

score 0 · Answer 1 · answered Oct 23 '18 at 12:22

You should use the Path type instead of String (https://docs.oracle.com/en/java/javase/11/docs/api/java.base/java/nio/file/Path.html)

it would look like something like this:

 Path path = Paths.get(properties.getProperty("DO.LIB.LOC"));
 path = path.resolve(Paths.get(request.getParameter("read")));

V.Aggarwal · Answer 2 · 2023-04-21T09:28:50.457

0

Something like this will work:

    List<String> INVALID_FILE_NAME_CHARACTERS = Arrays.asList("..", ":", "/", "\\");
    String filePath = properties.getProperty("DO.LIB.LOC");
    String fileName = (String) request.getParameter("read");

    // Validate inputs
    if(filePath==null || fileName==null) return;
    for(String character : B2BProfileConstant.INVALID_FILE_NAME_CHARACTERS) {
        if(fileName.contains(character)) return;
    }

    Path path = Paths.get(filePath).resolve(fileName).normalize();
    String finalPath = path.toString();

edited Apr 21 '23 at 09:28

answered Apr 18 '23 at 13:48

V.Aggarwal

557
4
12

I doubt it. You add a null check, and then return `null` when we don't know if the caller can handle that. But the real problem the linter is complaining about is that the code uses unsanitized, tainted user input. If someone enters `../../../../../etc/passwd` (with enough `../`s) they can eventually download the system's passwords file. – Robert Apr 18 '23 at 15:31
Thanks for pointing this out. Updated the code a bit. – V.Aggarwal Apr 21 '23 at 09:26

Coverity issues for Filesystem path, filename, or URI manipulation in java

2 Answers2

Linked