Page History

The CERT C Secure Coding Standard

FIO02-C. Canonicalize path names originating from untrusted sources

The CERT C++ Secure Coding Standard

FIO02-CPP. Canonicalize path names originating from untrusted sources

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="053ed5f82b591a85-2a84a4bf-4ab74882-af2084db-4e81711a25bcbb69fe4618d3"><ac:plain-text-body><![CDATA[

[ISO/IEC TR 24772:2010

http://www.aitcnet.org/isai/]

"Authentication Logic Error [XZOPath Traversal [EWR]"

]]></ac:plain-text-body></ac:structured-macro>

MITRE CWE

CWE ID 171, "Cleansing, Canonicalization, and Comparison Errors"

CWE ID 647, "Use of Non-Canonical URL Paths for Authorization Decisions"

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="7d37849ebe9386e5-60bf2608-41f84f5b-b4dc9c9c-0fc5e40a093f2d54a6d13558"><ac:plain-text-body><![CDATA[

[[API 2006

AA. Bibliography#API 06]]

[method getCanonicalPath()

http://java.sun.com/javase/6/docs/api/java/io/File.html#getCanonicalPath()]

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="2f91366e1954e734-40334051-449546f1-99e8848b-f7c1240380ca48caf5b4b4f2"><ac:plain-text-body><![CDATA[

[[Harold 1999

AA. Bibliography#Harold 99]]

]]></ac:plain-text-body></ac:structured-macro>