Skip to content

Commit 158ff0d

Browse files
committed
add a trailing slash to the folder check in the QHelp for java/path-injection
1 parent 00dadeb commit 158ff0d

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

java/ql/src/Security/CWE/CWE-022/examples/TaintedPathGoodFolder.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ public void sendUserFileGood(Socket sock, String user) {
77
Path filePath = publicFolder.resolve(filename).normalize().toAbsolutePath();
88

99
// GOOD: ensure that the path stays within the public folder
10-
if (!filePath.startsWith(publicFolder)) {
10+
if (!filePath.startsWith(publicFolder + File.separator)) {
1111
throw new IllegalArgumentException("Invalid filename");
1212
}
1313
BufferedReader fileReader = new BufferedReader(new FileReader(filePath.toString()));

0 commit comments

Comments
 (0)