the-web-application-hackers-handbook

380 Chapter 10 n Attacking Back-End Components
is not possible, the application can maintain a hard-coded list of image files that
may be served by the page. It can use a different identifier to specify which
file is required, such as an index number. Any request containing an invalid
identifier can be rejected, and there is no attack surface for users to manipulate
the path of files delivered by the page.
In some cases, as with the work flow functionality that allows file uploading
and downloading, it may be desirable to allow users to specify files by name.
Developers may decide that the easiest way to implement this is by passing
the user-supplied filename to filesystem APIs. In this situation, the application
should take a defense-in-depth approach to place several obstacles in the way
of a path traversal attack.
Here are some examples of defenses that may be used; ideally, as many of
these as possible should be implemented together:
n After performing all relevant decoding and canonicalization of the usersubmitted
filename, the application should check whether it contains either
of the path traversal sequences (using backslashes or forward slashes) or
any null bytes. If so, the application should stop processing the request. It
should not attempt to perform any sanitization on the malicious filename.
n The application should use a hard-coded list of permissible file types and
reject any request for a different type (after the preceding decoding and
canonicalization have been performed).
n After performing all its filtering on the user-supplied filename, the application
should use suitable filesystem APIs to verify that nothing is amiss
and that the file to be accessed using that filename is located in the start
directory specified by the application.
In Java, this can be achieved by instantiating a java.io.File object using
the user-supplied filename and then calling the getCanonicalPath method
on this object. If the string returned by this method does not begin with the
name of the start directory, the user has somehow bypassed the application’s
input filters, and the request should be rejected.
In ASP.NET, this can be achieved by passing the user-supplied filename
to the System.Io.Path.GetFullPath method and checking the returned
string in the same way as described for Java.
The application can mitigate the impact of most exploitable path traversal
vulnerabilities by using a chrooted environment to access the directory containing
the files to be accessed. In this situation, the chrooted directory is treated as