CODEWITHSUNDEEP
securitypathfilepath
a.l.e
a.l.e

Reputation: 868

Making sure that a path does not break out of a base path

In a web application, I get a path from the request, which I then append to a (safe) base path.
The web application has the full control over the files inside of the base path, but is not allowed to break out of it.

I need to make sure that the resulting path (base path + get path) is inside the base path.

Is it safe (and enough) to check if the path is valid by:

If the path is not valid it's simply refused, otherwise I create or delete the file with the given path (depending on the action...)

Some further information:

Upvotes: 0

Views: 21

Answers (1)

chaos
chaos

Reputation: 124335

I can't think of a way within the Unix/Windows/MacOS systems I'm familiar with for the methodology you're talking about to go wrong. That said, it's fundamentally a low reliability methodology that's completely vulnerable to obscure corner cases in, or changes to, the software that translates your filenames into file system locations. I would always prefer to use actual file system routines to fully resolve the path and then verify that that is present within the area you want.

Upvotes: 1

Related Questions