Skip to content

Commit aafecae

Browse files
committed
update metadata files
1 parent 70bbb80 commit aafecae

File tree

19 files changed

+51
-40
lines changed

19 files changed

+51
-40
lines changed

Path Manipulation/README.md

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,14 +3,16 @@
33
## Definition as per OWASP
44
**Path Manipulation** attack also known as **Path Traversal** attack, aims to access files and directories that are stored outside the web root folder. By manipulating variables that reference files with “dot-dot-slash (../)” sequences and its variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system including application source code or configuration and critical system files. It should be noted that access to files is limited by system operational access control (such as in the case of locked or in-use files on the Microsoft Windows operating system).
55

6-
This attack is also known as _“dot-dot-slash”_, _“directory traversal”_, _“directory climbing”_ and _“backtracking”_.
6+
This attack is also known as **"dot-dot-slash"**, **"directory traversal"**, **"directory climbing"** and **"backtracking"**.
7+
8+
You can use this repo as reference to fix the Path Manipulation issue [CWE-22](https://cwe.mitre.org/data/definitions/22.html), [CWE-34](https://cwe.mitre.org/data/definitions/34.html), [CWE-35](https://cwe.mitre.org/data/definitions/35.html), [CWE-73](https://cwe.mitre.org/data/definitions/73.html)
79

810
## Mitigation
911

1012
Path Manipulation can be mitigated by validating the filename, folder name and extension validation and use the values further in the code only after the validations.
1113

1214
## NOTE
13-
The code for the Path Manipulation only check for the Filename validation, Extension Validation, File Size Validation, Unique Filename Validation. ___It doesn't check for the File Contents and Magic Numbers. Use this logic when you are concerned about the Path Manipulation issue ONLY___.
15+
The code for the Path Manipulation only check for the Filename validation, Extension Validation, File Size Validation, Unique Filename Validation. ***It doesn't check for the File Contents and Magic Numbers. Use this logic when you are concerned about the Path Manipulation issue ONLY***.
1416

1517
The Path Manipulation logic checks for the following:
1618
- The Filename Validation, to only contain Alphanumeric values with the help of regex.
@@ -24,6 +26,8 @@ Path Manipulation
2426
├───while File Read
2527
│ ├───java
2628
│ │ └───fileread.pathmanipulation
29+
│ │ ├───.mvn
30+
│ │ │ └───wrapper
2731
│ │ └───src
2832
│ │ ├───main
2933
│ │ │ ├───java
@@ -40,12 +44,14 @@ Path Manipulation
4044
│ └───python
4145
│ └───securecodingexamples
4246
│ └───fileread
43-
│ └───pathmaniuplation
47+
│ └───pathmanipulation
4448
│ └───src
4549
│ └───templates
4650
└───while File Upload
4751
├───java
4852
│ └───fileupload.pathmanipulation
53+
│ ├───.mvn
54+
│ │ └───wrapper
4955
│ └───src
5056
│ ├───main
5157
│ │ ├───java
@@ -64,5 +70,6 @@ Path Manipulation
6470
└───fileupload
6571
└───pathmanipulation
6672
└───src
67-
└───templates
73+
├───templates
74+
└───tests
6875
```

Path Manipulation/while File Read/java/fileread.pathmanipulation/pom.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
<artifactId>fileread.pathmanipulation</artifactId>
1313
<version>0.0.1-SNAPSHOT</version>
1414
<name>fileread.pathmanipulation</name>
15-
<description>Path Manipulation Secure Coding Example with File Read</description>
15+
<description>Mitigating the issue of Path Manipulation (CWE-22), (CWE-34), (CWE-35), (CWE-73)</description>
1616
<url/>
1717
<licenses>
1818
<license/>

Path Manipulation/while File Read/python/README.md

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -11,20 +11,20 @@ This python project is to help to mitigate the path manipulation issues. You can
1111

1212
You can try to play around this by following the Installation steps, check the Usage to run the Flask app.
1313

14-
## Installation
15-
1614
Please note that this project will try to fetch the files from your ___TEMP/Uploads___ directory. You can either manually create your files in the directory, or you can navigate to [Path Manipulation while File Upload Python Project](../../Path%20Manipulation%20while%20File%20Upload/python/) and follow the installation steps and Upload the test files.
1715

18-
_TEMP : temporary Folder in your OS_
16+
*TEMP : temporary Folder in your OS*
1917

20-
_%TEMP% Directory in Windows_
18+
*%TEMP% Directory in Windows*
2119

22-
_/tmp Directory in Linux/MacOS_
20+
*/tmp Directory in Linux/MacOS*
21+
22+
## Installation
2323

2424
1. Clone the repository:
2525
```sh
2626
git clone https://github.com/sahildari/secure-coding-examples
27-
cd 'Path Manipulation/Path Manipulation while File Read/python'
27+
cd 'Path Manipulation/while File Read/python'
2828
```
2929
2. Install the package:
3030
```sh

Path Manipulation/while File Read/python/setup.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
setup(
99
name="fileread.pathmaniuplation",
1010
version="0.0.1",
11-
description="A simple path manipulation example",
11+
description="Secure Coding Example Mitigating the issue of Path Manipulation (CWE-22), (CWE-34), (CWE-35), (CWE-73)",
1212
long_description=long_description,
1313
long_description_content_type="text/markdown",
1414
package_dir={"": "securecodingexamples"},

Path Manipulation/while File Upload/java/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ This maven project is to help to mitigate the path manipulation issues. You can
1414
1. Clone the repository:
1515
```sh
1616
git clone https://github.com/sahildari/secure-coding-examples
17-
cd 'Path Manipulation/Path Manipulation while File Upload/java'
17+
cd 'Path Manipulation/while File Upload/java'
1818
```
1919
2. Install the package:
2020

Path Manipulation/while File Upload/java/fileupload.pathmanipulation/pom.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
<artifactId>fileupload.pathmanipulation</artifactId>
1313
<version>0.0.1-SNAPSHOT</version>
1414
<name>fileupload.pathmanipulation</name>
15-
<description>Path Manipulation Secure Coding Example</description>
15+
<description>Mitigating the issue of Path Manipulation (CWE-22), (CWE-34), (CWE-35), (CWE-73)</description>
1616
<url/>
1717
<licenses>
1818
<license/>

Path Manipulation/while File Upload/python/README.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,14 +9,14 @@ This python project is to help to mitigate the path manipulation issues. You can
99

1010
[template](./securecodingexamples/fileupload/pathmanipulation/src/templates/) directory contains the index.html as frontend for the file upload with file type check on the client side.
1111

12-
You can try to play around this by following the Installation steps, check the Usage to run the Flask app.
12+
You can try to play around by following the [Installation](#) steps, check the Usage to run the Flask app.
1313

1414
## Installation
1515

1616
1. Clone the repository:
1717
```sh
1818
git clone https://github.com/sahildari/secure-coding-examples
19-
cd 'Path Manipulation/Path Manipulation while File Upload/python'
19+
cd 'Path Manipulation/while File Upload/python'
2020
```
2121
2. Install the package:
2222
```sh
Binary file not shown.

0 commit comments

Comments
 (0)