hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 03:05:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Inline qhelp overview

Browse Source 
A <p> at the top isn't allowed, and for some reason the inclusion is required to be a valid qhelp file.
This commit is contained in:
Chris Smowton
2022-08-09 18:58:27 +01:00
parent cf68a11267
commit 2ca0b0c6b5
3 changed files with 8 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
java/ql/src/Security/CWE/CWE-023/PartialPathTraversal.qhelp
View File

@@ -3,7 +3,10 @@
"qhelp.dtd">
<qhelp>
<overview>
<include src="PartialPathTraversalOverview.inc.qhelp"/>
<p>A common way to check that a user-supplied path <code>SUBDIR</code> falls inside a directory <code>DIR</code>
is to use <code>getCanonicalPath()</code> to remove any path-traversal elements and then check that <code>DIR</code>
is a prefix. However, if <code>DIR</code> is not slash-terminated, this can unexpectedly allow accessing siblings of <code>DIR</code>.</p>
<p>See also <code>java/partial-path-traversal-from-remote</code>, which is similar to this query but only flags instances with evidence of remote exploitability</p>
</overview>

5
java/ql/src/Security/CWE/CWE-023/PartialPathTraversalFromRemote.qhelp
View File

@@ -3,7 +3,10 @@
"qhelp.dtd">
<qhelp>
<overview>
<include src="PartialPathTraversalOverview.inc.qhelp"/>
<p>A common way to check that a user-supplied path <code>SUBDIR</code> falls inside a directory <code>DIR</code>
is to use <code>getCanonicalPath()</code> to remove any path-traversal elements and then check that <code>DIR</code>
is a prefix. However, if <code>DIR</code> is not slash-terminated, this can unexpectedly allow accessing siblings of <code>DIR</code>.</p>
<p>See also <code>java/partial-path-traversal</code>, which is similar to this query,
but may also flag non-remotely-exploitable instances of Partial Path Traversal.</p>
</overview>

10
java/ql/src/Security/CWE/CWE-023/PartialPathTraversalOverview.inc.qhelp
View File

@@ -1,10 +0,0 @@
<!DOCTYPE qhelp PUBLIC
"-//Semmle//qhelp//EN"
"qhelp.dtd">
<qhelp>
<p>A common way to check that a user-supplied path <code>SUBDIR</code> falls inside a directory <code>DIR</code>
is to use <code>getCanonicalPath()</code> to remove any path-traversal elements and then check that <code>DIR</code>
is a prefix. However, if <code>DIR</code> is not slash-terminated, this can unexpectedly allow accessing siblings of <code>DIR</code>.</p>
</qhelp>