135
the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on
looking for malicious or malformed inputs. This is likely to miss at least one undesirable input,
especially if the code's environment changes. This can give attackers enough room to bypass
the intended validation. However, denylists can be useful for detecting potential attacks or
determining which inputs are so malformed that they should be rejected outright. When validating
filenames, use stringent allowlists that limit the character set to be used. If feasible, only allow a
single "." character in the filename to avoid weaknesses such as CWE-23, and exclude directory
separators such as "/" to avoid CWE-36. Use a list of allowable file extensions, which will help
to avoid CWE-434. Do not rely exclusively on a filtering mechanism that removes potentially
dangerous characters. This is equivalent to a denylist, which may be incomplete (CWE-184). For
example, filtering "/" is insufficient protection if the filesystem also supports the use of "\" as a
directory separator. Another possible error could occur when the filtering is applied in a way that
still produces dangerous data (CWE-182). For example, if "../" sequences are removed from the
".../...//" string in a sequential fashion, two instances of "../" would be removed from the original
string, but the remaining characters would still form the "../" string.
Effectiveness = High
Phase: Implementation
Use a built-in path canonicalization function (such as realpath() in C) that produces the canonical
version of the pathname, which effectively removes ".." sequences and symbolic links (CWE-23,
CWE-59).
Phase: Installation
Phase: Operation
Use OS-level permissions and run as a low-privileged user to limit the scope of any successful
attack.
Phase: Operation
Phase: Implementation
If you are using PHP, configure your application so that it does not use register_globals. During
implementation, develop your application so that it does not rely on this feature, but be wary
of implementing a register_globals emulation that is subject to weaknesses such as CWE-95,
CWE-621, and similar issues.
Phase: Testing
Use tools and techniques that require manual (human) analysis, such as penetration testing,
threat modeling, and interactive tools that allow the tester to record and modify an active session.
These may be more effective than strictly automated techniques. This is especially the case with
weaknesses that are related to design and business rules.
Demonstrative Examples
Example 1:
The following code uses input from an HTTP request to create a file name. The programmer has
not considered the possibility that an attacker could provide a file name such as "../../tomcat/conf/
server.xml", which causes the application to delete one of its own configuration files (CWE-22).
Example Language: Java (Bad)
String rName = request.getParameter("reportName");
File rFile = new File("/usr/local/apfr/reports/" + rName);
...
rFile.delete();
Example 2:
CWE Version 4.14
CWE-73: External Control of File Name or Path
CWE-73: External Control of File Name or Path