hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-14 11:19:27 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #21652 from MarkLee131/fix/path-injection-torealpath

Browse Source 
Java: recognize Path.toRealPath() as path normalization sanitizer
This commit is contained in:
Owen Mansel-Chan
2026-04-23 11:18:23 +01:00
committed by GitHub
parent d6abd4c72d 9f19791d8c
commit bf960b8c76
3 changed files with 26 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
java/ql/lib/change-notes/2026-04-04-path-injection-torealpath.md Normal file
View File

@@ -0,0 +1,4 @@
---
category: minorAnalysis
---
* The `java/path-injection` and `java/zipslip` queries now recognize `Path.toRealPath()` as a path normalization sanitizer, consistent with the existing treatment of `Path.normalize()` and `File.getCanonicalPath()`. This reduces false positives for code that uses the NIO.2 API for path canonicalization.

2
java/ql/lib/semmle/code/java/security/PathSanitizer.qll
View File

@@ -243,7 +243,7 @@ private class PathNormalizeSanitizer extends MethodCall {
PathNormalizeSanitizer() {
exists(RefType t | this.getMethod().getDeclaringType() = t |
(t instanceof TypePath or t instanceof FilesKt) and
this.getMethod().hasName("normalize")
this.getMethod().hasName(["normalize", "toRealPath"])
or
t instanceof TypeFile and
this.getMethod().hasName(["getCanonicalPath", "getCanonicalFile"])

21
java/ql/test/query-tests/security/CWE-022/semmle/tests/TaintedPath.java
View File

@@ -72,6 +72,27 @@ public class TaintedPath {
}
}
public void sendUserFileGood5(Socket sock, String user) throws Exception {
BufferedReader filenameReader =
new BufferedReader(new InputStreamReader(sock.getInputStream(), "UTF-8"));
String filename = filenameReader.readLine();
Path publicFolder = Paths.get("/home/" + user + "/public").toRealPath();
Path filePath = publicFolder.resolve(filename).toRealPath();
// GOOD: toRealPath() normalizes the path (resolves ".." and symlinks),
// equivalent to File.getCanonicalPath()
if (!filePath.startsWith(publicFolder + File.separator)) {
throw new IllegalArgumentException("Invalid filename");
}
BufferedReader fileReader = new BufferedReader(new FileReader(filePath.toString()));
String fileLine = fileReader.readLine();
while (fileLine != null) {
sock.getOutputStream().write(fileLine.getBytes());
fileLine = fileReader.readLine();
}
}
public void sendUserFileGood4(Socket sock, String user) throws IOException {
BufferedReader filenameReader =
new BufferedReader(new InputStreamReader(sock.getInputStream(), "UTF-8"));