...
Recommendation | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
IDS21-J | medium | unlikely | medium | P4 | L3 |
Related Vulnerabilities
Other Languages
This rule appears in the C Secure Coding Standard as FIO02-C. Canonicalize path names originating from untrusted sources.
This rule appears in the C++ Secure Coding Standard as FIO02-CPP. Canonicalize path names originating from untrusted sources.
Related Vulnerabilities
| ||||
| ||||
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="6f0d706c-a6da-4f63-9bcf-862b5a290762"><ac:plain-text-body><![CDATA[ | [[MITRE 2009 | AA. Bibliography#MITRE 09]] | [CWE ID 171 | http://cwe.mitre.org/data/definitions/171.html] "Cleansing, Canonicalization, and Comparison Errors"]]></ac:plain-text-body></ac:structured-macro> |
| CWE ID 647 "Use of Non-Canonical URL Paths for Authorization Decisions" |
Bibliography
<ac:structured-macro ac:name="unmigrated-wiki-markup |
...
" ac:schema-version="1" ac:macro-id="721fb159-3fea-4f5f-8fc9-06111716f45b"><ac:plain-text-body><![CDATA[ | [[API |
...
2006 |
...
AA. |
...
Bibliography#API |
...
06] |
...
] |
...
[method |
...
getCanonicalPath() |
...
http://java.sun.com/javase/6/docs/api/java/io/File.html#getCanonicalPath() |
...
] | ]]></ac:plain-text-body></ac:structured-macro> |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="b9fe9c10-16ac-4b5f-8b4c-143a3b62645d"><ac:plain-text-body><![CDATA[ | [[API |
...
2006 |
...
AA. |
...
Bibliography#API |
...
06] |
...
] |
...
[method |
...
getCanonicalFile() |
...
http://java.sun.com/javase/6/docs/api/java/io/File.html#getCanonicalFile() |
...
] | ]]></ac:plain-text-body></ac:structured-macro> |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="fdc2d5e7-7cd4-4988-9a04-cc2208947141"><ac:plain-text-body><![CDATA[ | [[Harold |
...
1999 |
...
AA. |
...
Bibliography#Harold |
...
99] |
...
] |
| ]]></ac:plain-text-body></ac:structured-macro> |
...
IDS20-J. Exclude user input from format strings IDS22-J. Limit the size of files passed to ZipInputStream