the-web-application-hackers-handbook

Chapter 19 n Finding Vulnerabilities in Source Code 713
Table 19-2: APIs Used to Interact with the User’s Session on the Java Platform
API
setAttribute
DESCRIPTION
Used to store data within the current session.
putValue
getAttribute
Used to query data stored within the current session.
getValue
getAttributeNames
getValueNames
Potentially Dangerous APIs
This section describes some common Java APIs that can introduce security
vulnerabilities if used in an unsafe manner.
File Access
The main class used to access files and directories in Java is java.io.File.
From a security perspective, the most interesting uses of this class are calls to
its constructor, which may take a parent directory and filename, or simply a
pathname.
Whichever form of the constructor is used, path traversal vulnerabilities
may exist if user-controllable data is passed as the filename parameter without
checking for dot-dot-slash sequences. For example, the following code opens a
file in the root of the C:\ drive on Windows:
String userinput = “..\\boot.ini”;
File f = new File(“C:\\temp”, userinput);
The classes most commonly used for reading and writing file contents in
Java are:
n java.io.FileInputStream
n java.io.FileOutputStream
n java.io.FileReader
n java.io.FileWriter
These classes take a File object in their constructors or may open a file
themselves via a filename string, which may again introduce path traversal
vulnerabilities if user-controllable data is passed as this parameter. For example:
String userinput = “..\\boot.ini”;
FileInputStream fis = new FileInputStream(“C:\\temp\\” + userinput);