Page Information

Title:	IDS00-PL. Canonicalize path names before validating them
Author:	David Svoboda	Jun 25, 2012
Last Changed by:	Francesco Mariani	Aug 04, 2025
Tiny Link: (useful for email)	https://wiki.sei.cmu.edu/confluence/x/uVxMBQ
Export As:	Word · PDF

SEI CERT Perl Coding Standard (1)     Page: FIO01-PL. Do not operate on files that can be modified by untrusted users

Parent Page     Page: Rec. 01. Input Validation and Data Sanitization (IDS)

• recommendation
• ids

Time	Editor
Aug 04, 2025 12:31	Francesco Mariani	View Changes
Nov 16, 2017 14:45	Will Snavely	View Changes
Mar 31, 2015 18:27	Will Snavely	View Changes
Mar 31, 2015 18:07	Will Snavely	View Changes
Mar 26, 2015 20:56	Will Snavely

External Links (9)
    search.cpan.org/%7Erbs/File-PathConvert/PathConvert.pm
    www.kb.cert.org/vuls/id/764027
    search.cpan.org/~rbs/File-PathConvert/PathConvert.pm
    https://www.securecoding.cert.org/confluence/display/seccod…
    www.kb.cert.org/vuls/id/806091
    search.cpan.org/%7Esmueller/PathTools-3.33/lib/File/Spec.pm
    https://wiki.sei.cmu.edu/confluence/pages/viewpage.action?p…
    perldoc.perl.org/Cwd.html
    https://wiki.sei.cmu.edu/confluence/pages/viewpage.action?p…

SEI CERT C Coding Standard (2)     Page: FIO02-C. Canonicalize path names originating from tainted sources     Home page: SEI CERT C Coding Standard

SEI CERT Oracle Coding Standard for Java (2)     Page: MET02-J. Do not use deprecated or obsolete classes or methods     Home page: SEI CERT Oracle Coding Standard for Java

SEI CERT Perl Coding Standard (4)     Page: Security Reviewer - Static Reviewer     Home page: SEI CERT Perl Coding Standard     Page: AA. Bibliography     Page: FIO01-PL. Do not operate on files that can be modified by untrusted users

SEI CERT C++ Coding Standard (2)     Page: VOID FIO02-CPP. Canonicalize path names originating from untrusted sources     Home page: SEI CERT C++ Coding Standard