CWE-797 仅在一个绝对路径位置过滤特殊元素 类漏洞列表 1

The following code takes untrusted input and uses a substring function to filter a 3-character "../" element located at the 0-index position of the input string. It then appends this result to the /home/user/ directory and attempts to read the file in the final resulting path.

my $Username = GetUntrustedInput(); if (substr($Username, 0, 3) eq '../') { $Username = substr($Username, 3); } my $filename = "/home/user/" . $Username; ReadAndSendFile($filename);

../../../etc/passwd