CWE-23: Relative Path Traversal

http://example.com/get-files.jsp?file=report.pdfhttp://example.com/get-page.php?home=aaa.htmlhttp://example.com/some-page.asp?page=index.html

http://example.com/get-files?file=../../../../somedir/somefilehttp://example.com/../../../../etc/shadowhttp://example.com/get-files?file=../../../../etc/passwd

my $dataPath = "/users/cwe/profiles";my $username = param("user");my $profilePath = $dataPath . "/" . $username;
                     open(my $fh, "<", $profilePath) || ExitError("profile read error: $profilePath");print "<ul>\n";while (<$fh>) {print "<li>$_</li>\n";}print "</ul>\n";

../../../etc/passwd

/users/cwe/profiles/../../../etc/passwd

/etc/passwd

<form action="FileUploadServlet" method="post" enctype="multipart/form-data">
                     Choose a file to upload:<input type="file" name="filename"/><br/><input type="submit" name="submit" value="Submit"/>
                     </form>

public class FileUploadServlet extends HttpServlet {
                     
                        ...
                           protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
                           
                              response.setContentType("text/html");PrintWriter out = response.getWriter();String contentType = request.getContentType();
                                 // the starting position of the boundary headerint ind = contentType.indexOf("boundary=");String boundary = contentType.substring(ind+9);
                                 String pLine = new String();String uploadLocation = new String(UPLOAD_DIRECTORY_STRING); //Constant value
                                 // verify that content type is multipart form dataif (contentType != null && contentType.indexOf("multipart/form-data") != -1) {
                                 
                                    // extract the filename from the Http headerBufferedReader br = new BufferedReader(new InputStreamReader(request.getInputStream()));...pLine = br.readLine();String filename = pLine.substring(pLine.lastIndexOf("\\"), pLine.lastIndexOf("\""));...
                                       // output the file to the local upload directorytry {
                                          BufferedWriter bw = new BufferedWriter(new FileWriter(uploadLocation+filename, true));for (String line; (line=br.readLine())!=null; ) {if (line.indexOf(boundary) == -1) {bw.write(line);bw.newLine();bw.flush();}} //end of for loopbw.close();
                                       
                                       
                                       } catch (IOException ex) {...}// output successful upload response HTML page
                                 }// output unsuccessful upload response HTML pageelse{...}
                           }...
                        
                     }