7. of Tampering I
An attacker can bypass permissions because you don’t make names canonical before checking access permissions:
|
Threat |
|
|
|
You’re accepting user-supplied paths without getting the canonical form before making access control decisions. A user can supply a relative path, allowing them to access other areas of the filesystem. For example, by supplying the In this case, they may be able to overwrite files in the |
|
CAPEC |
CAPEC-126: Path Traversal CAPEC-139: Relative Path Traversal |
|
ASVS |
12.3.1: Ensure that a URL API is used to protect against path traversal attacks |
