This product is not supported for your selected
Datadog site . (
).
이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우
언제든지 연락주시기 바랍니다.
이 규칙을 사용해 보세요 ID: java-security/spring-request-file-tainted
Language: Java
Severity: Notice
Category: Security
CWE : 23
Description An attacker could try to pass a filename of content that could traverse the server path and control system files. Make sure all user-inputs is checked and sanitized before use.
Learn More Non-Compliant Code Examples class Test {
@PostMapping ( value = "/fileupload" )
public ModelAndView importFile ( @RequestParam ( "file" ) MultipartFile myFile ) throws IOException {
var user = ( WebGoatUser ) SecurityContextHolder . getContext (). getAuthentication (). getPrincipal ();
var destinationDir = new File ( fileLocation , user . getUsername ());
destinationDir . mkdirs ();
myFile . transferTo ( new File ( destinationDir , myFile . getOriginalFilename ()));
log . debug ( "File saved to {}" , new File ( destinationDir , myFile . getOriginalFilename ()));
return new ModelAndView (
new RedirectView ( "files" , true ),
new ModelMap (). addAttribute ( "uploadSuccess" , "File uploaded successful" ));
}
}
원활한 통합. Datadog Code Security를 경험해 보세요
