Incomplete Filtering of Multiple Instances of Special Elements |
Weakness ID: 794 (Weakness Variant) | Status: Incomplete |
Description Summary
Extended Description
Incomplete filtering of this nature may be applied to
1) sequential elements (special elements that appear next to each other) or
2) non-sequential elements (special elements that appear multiple times in different locations).
Example 1
The following code takes untrusted input and uses a regular expression to filter "../" from the input. It then appends this result to the /home/user/ directory and attempts to read the file in the final resulting path.
Since the regular expression does not have the /g global match modifier, it only removes the first instance of "../" it comes across. So an input value such as:
will have the first "../" stripped, resulting in:
This value is then concatenated with the /home/user/ directory:
which causes the /etc/passwd file to be retrieved once the operating system has resolved the ../ sequences in the pathname. This leads to relative path traversal (CWE-23).
Nature | Type | ID | Name | View(s) this relationship pertains to |
---|---|---|---|---|
ChildOf | Weakness Variant | 792 | Incomplete Filtering of One or More Instances of Special Elements | Research Concepts (primary)1000 |