利用路径遍历漏洞的常见障碍
Common obstacles to exploiting path traversal vulnerabilities
应用程序可能要求用户提供的文件名以预期的文件扩展名结尾，例如.png .在这种情况下，可以使用 null 字节在所需扩展名之前有效地终止文件路径。例如：filename=../../../etc/passwd%00.png。
An application may require the user-supplied filename to end with an expected file extension, such as .png. In this case, it might be possible to use a null byte to effectively terminate the file path before the required extension. For example: filename=../../../etc/passwd%00.png.
Lab: File path traversal, validation of file extension with null byte bypass
This lab contains a path traversal vulnerability in the display of product images.
The application validates that the supplied filename ends with the expected file extension.
To solve the lab, retrieve the contents of the /etc/passwd file.
实验步骤
5a30fc5e-9f40-4f10-87c2-077b12e90764-image.png
如何防止路径遍历攻击
How to prevent a path traversal attack
防止路径遍历漏洞的最有效方法是完全避免将用户提供的输入传递给文件系统 API。许多执行此操作的应用程序函数可以重写，以更安全的方式提供相同的行为。
The most effective way to prevent path traversal vulnerabilities is to avoid passing user-supplied input to filesystem APIs altogether. Many application functions that do this can be rewritten to deliver the same behavior in a safer way.
如果您无法避免将用户提供的输入传递给文件系统 API，我们建议使用两层防御来防止攻击：
If you can't avoid passing user-supplied input to filesystem APIs, we recommend using two layers of defense to prevent attacks:
*在处理用户输入之前对其进行验证。理想情况下，将用户输入与允许值的白名单进行比较。如果无法做到这一点，请验证输入是否仅包含允许的内容，例如仅包含字母数字字符。 （Validate the user input before processing it. Ideally, compare the user input with a whitelist of permitted values. If that isn't possible, verify that the input contains only permitted content, such as alphanumeric characters only.）
验证提供的输入后，将输入附加到基目录，并使用平台文件系统 API 对路径进行规范化。验证规范化路径是否以预期的基目录开头。（After validating the supplied input, append the input to the base directory and use a platform filesystem API to canonicalize the path. Verify that the canonicalized path starts with the expected base directory.）
下面是一个简单的 Java 代码示例，用于根据用户输入验证文件的规范路径：
（Below is an example of some simple Java code to validate the canonical path of a file based on user input:）
File file = new File(BASE_DIRECTORY, userInput);
if (file.getCanonicalPath().startsWith(BASE_DIRECTORY)) {
// process file
}
