0

I am using the Checkmarx security tool to scan my code. I am getting:

Improper Access Control Authorization

on read/write method while writing data to output stream from file.

private ByteArrayOutputStream createToByteArray(String fileName) throws IOException {
        byte[] buf = new byte[1024];
        try (InputStream is = Files.newInputStream(Paths.get(fileName))) {
            int len = is.read(buf);
            ByteArrayOutputStream os = new ByteArrayOutputStream();
            while (len != -1) {
                os.write(buf, 0, len);
                len = is.read(buf);
            }
            return os;
        }
    }
Azametzin
  • 5,223
  • 12
  • 28
  • 46
Rishabh
  • 1
  • 1
  • 3
  • Does this answer your question? [Checkmarx Improper Resource Access Authorization](https://stackoverflow.com/questions/57824178/checkmarx-improper-resource-access-authorization) – baruchiro May 17 '20 at 15:04

2 Answers2

2

If anyone is getting low severity at below specific part in checkmarx.

Paths.get(fileName)

then try using resolve() method like

Paths.get(fileName).resolve("")

resolve () -> this method is used to resolve the given path against this path.

for more info on resolve(), refer this

Ravi
  • 338
  • 1
  • 12
0

You expect the user can read a file from the file system, by path, and convert it to ByteStream. Fine.

But what if the user giving you an absolute file path? Or relative one (../../.ssh/id_rsa, for example)?

No matter who is sending the request, the access permissions of the request is actually the server access permissions (because this code runs on the server, of course).

So you need to validate the user access permissions, for avoiding Improper Access Control Authorization.

Example from this answer:

if (user.equals("admin")){
   try (InputStream is = Files.newInputStream(Paths.get(fileName))) {
      ...
   }
}

Also, my suggestion is to remove any relative path from the filename input path.

baruchiro
  • 5,088
  • 5
  • 44
  • 66
  • user is already validated with Spring Security Authentication and Authorization at global level. I assume it is bad design to validate it everytime we are doing read/write operation. – Rishabh May 20 '20 at 09:18