如何修复Fortify路径操纵（输入验证和表示，数据流）漏洞

Question

I am getting fortify path manipulation vulnerability for creating a file with new keyword

I have tried to sanitize the path before passing it to File object, but the problem persists. Tried this link also: https://www.securecoding.cert.org/confluence/display/java/FIO00-J.+Do+not+operate+on+files+in+shared+directories

public static String sanitizePath(String sUnsanitized) throws URISyntaxException, EncodingException {

   String sSanitized = SAPI.encoder().canonicalize(sUnsanitized);
   return sSanitized;

}


//// the main method code snippet /////

String sSanitizedPath = Utils.sanitizePath(file.getOriginalFilename());

-- fortify scan detects problem here ..in below line --

File filePath = new File(AppInitializer.UPLOAD_LOCATION, sSanitizedPath);

String canonicalPath = filePath.getCanonicalPath();
FileOutputStream fileOutputStream = new FileOutputStream(canonicalPath);

After the santizePath , I thought the scan will be not pick ,vulnerabilit but , it did.

Answer 1

This "sUnsanitized" variable comes from user input? Maybe this is your real problem.

Never trust in user input its a number one rule to develpment.