From e53ed478abcb2791e8fbf532afa396576bf9d571 Mon Sep 17 00:00:00 2001 From: Rasmus Wriedt Larsen Date: Thu, 3 Dec 2020 11:08:34 +0100 Subject: [PATCH] Python: Highlight os.path.join behavior with absolute paths --- python/ql/src/Security/CWE-022/PathInjection.qhelp | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/python/ql/src/Security/CWE-022/PathInjection.qhelp b/python/ql/src/Security/CWE-022/PathInjection.qhelp index 200a4e78f98..fbcb60c26fa 100644 --- a/python/ql/src/Security/CWE-022/PathInjection.qhelp +++ b/python/ql/src/Security/CWE-022/PathInjection.qhelp @@ -43,7 +43,8 @@ In the second example, it appears that the user is restricted to opening a file special characters. For example, the string "../../../etc/passwd" will result in the code reading the file located at "/server/static/images/../../../etc/passwd", which is the system's password file. This file would then be sent back to the user, giving them access to all the -system's passwords. +system's passwords. Note that it is still possible to use an absolute path, since the result of +os.path.join("/server/static/images/", "/etc/passwd") is "/etc/passwd".