hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-27 09:45:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #11540 from github/smowton/fix/path-injection-example-syntax-error

Browse Source 
Java: fix syntax error in path-injection example fix
This commit is contained in:
Chris Smowton
2022-12-02 11:47:53 +00:00
committed by GitHub
parent 194b754880 6e98c67869
commit fef03a0806
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
java/ql/src/Security/CWE/CWE-022/TaintedPath.java
View File

@@ -16,9 +16,9 @@ public void sendUserFileFixed(Socket sock, String user) {
// ...
// GOOD: remove all dots and directory delimiters from the filename before using
String filename = filenameReader.readLine().replaceAll("\.", "").replaceAll("/", "");
String filename = filenameReader.readLine().replaceAll("\\.", "").replaceAll("/", "");
BufferedReader fileReader = new BufferedReader(
new FileReader("/home/" + user + "/" + filename));
// ...
}
}