124
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Operating_System : macOS (Prevalence = Undetermined)
Background Details
The Apple HFS+ file system permits files to have multiple data input streams, accessible through
special paths. The Mac OS X operating system provides a way to access the different data input
streams through special paths and as an extended attribute:
- Resource fork: file/..namedfork/rsrc, file/rsrc (deprecated), xattr:com.apple.ResourceFork
- Data fork: file/..namedfork/data (only versions prior to Mac OS X v10.5)
Additionally, on filesystems that lack native support for multiple streams, the resource fork and file
metadata may be stored in a file with "._" prepended to the name.
Forks can also be accessed through non-portable APIs.
Forks inherit the file system access controls of the file they belong to.
Programs need to control access to these paths, if the processing of a file system object is
dependent on the structure of its path.
Common Consequences
Scope Impact Likelihood
Confidentiality
Integrity
Read Files or Directories
Modify Files or Directories
Demonstrative Examples
Example 1:
CWE Version 4.14
CWE-73: External Control of File Name or Path
CWE-73: External Control of File Name or Path