Page History

The CERT C Secure Coding Standard

FIO02-C. Canonicalize path names originating from untrusted sources

The CERT C++ Secure Coding Standard

FIO02-CPP. Canonicalize path names originating from untrusted sources

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="46a1d556fcb09693-6aee724a-45bc48f7-80c699ae-b3b205a05009372400e20ffa"><ac:plain-text-body><![CDATA[

[ISO/IEC TR 24772:2010

http://www.aitcnet.org/isai/]

Path Traversal [EWR]

]]></ac:plain-text-body></ac:structured-macro>

MITRE CWE

CWE-171. Cleansing, canonicalization, and comparison errors

CWE-647. Use of non-canonical URL paths for authorization decisions

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="c10b6bccf604f1db-bffc2330-42e64392-9e2897ff-cf924e4e7b2d36d5fde7ecf1"><ac:plain-text-body><![CDATA[

[[API 2006

AA. Bibliography#API References#API 06]]

[method getCanonicalPath()

http://java.sun.com/javase/6/docs/api/java/io/File.html#getCanonicalPath()]

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="3354a6b666ccd108-1d6fe187-48d5413d-89ed98c2-817fe3f8fef552021a6e441c"><ac:plain-text-body><![CDATA[

[[Harold 1999

AA. Bibliography#Harold References#Harold 99]]

]]></ac:plain-text-body></ac:structured-macro>