From 16814071df1d58a82479986362fc37bc9167c71b Mon Sep 17 00:00:00 2001 From: Shyam Mehta Date: Wed, 29 Jun 2022 18:03:57 -0400 Subject: [PATCH] Fix typo in .qhelp --- java/ql/src/Security/CWE/CWE-023/PartialPathTraversal.qhelp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/java/ql/src/Security/CWE/CWE-023/PartialPathTraversal.qhelp b/java/ql/src/Security/CWE/CWE-023/PartialPathTraversal.qhelp index be21879b3e2..741690bc904 100644 --- a/java/ql/src/Security/CWE/CWE-023/PartialPathTraversal.qhelp +++ b/java/ql/src/Security/CWE/CWE-023/PartialPathTraversal.qhelp @@ -28,7 +28,7 @@ returns a non-slash-terminated path string, so a "/" must be In this example, the if statement checks if parent.getCanonicalPath() -is a prefix of dir.getCanonicalPath(). However, parent.getCanonicalPath() is +is a prefix of dir.getCanonicalPath(). However, parent.getCanonicalPath() is not slash-terminated. So, the user that supplies dir may be allowed to access siblings of parent and not just children of parent, which is a security issue.