# V5332\. OWASP\. Possible path traversal vulnerability\. Potentially tainted data might be used to access files or folders outside a target directory\.

The analyzer has detected that data from an external source is used as file or folder paths without prior validation\. This makes the application vulnerable to path traversal attacks\.

This attack can be categorized under the OWASP Top 10 Application Security Risks classification as follows:

* [A01:2021 – Broken Access Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control/)

Path traversal attacks allow attackers to read, record, or delete files outside the target directory by processing the user input with special characters \(for example, `..`\)\. As a result, attackers can gain access to sensitive data—passwords, keys, and configurations—or disrupt the application\. For more details about the vulnerability, refer to the [terminology](https://pvs-studio.com/en/blog/terms/6470/)\.

The example:

```cpp
HttpServletRequest request;
HttpServletResponse response;

void write(Path userdir) throws IOException {

    ....

    String userFileRelativePath = request.getParameter("relativePath");

    Path fullPath = userdir.resolve(userFileRelativePath);
    String content = Files.readString(fullPath);

    ....

    response.getWriter().write(content);
}
```

The method sends the contents of some file from the specified user folder\. Users are expected to access only the files stored within this specified directory\.

An externally supplied value from `request.getParameter` is used as a relative path without validation\. This creates a path traversal vulnerability, enabling attackers to access the contents of any files on the system\.

For example, each user's folder may contain the `userInfo.xml` file that stores various sensitive data\. Assume the code is executed on Windows\. In this case, attackers can pass the following string to `request.getParameter("relativePath")` to access `admin` user's data:

```cpp
..\admin\userInfo.xml
```

To protect against such attacks, simply checking whether the path starts with `..` is insufficient\. For example, the following string could also access the same sensitive data:

```cpp
someFolder\..\..\admin\userInfo.xml
```

Additionally, attackers could pass the absolute path instead of the relative one\. If the `Path#resolve` argument is the absolute path, the original one will be completely ignored\. For example, the method can be called as follows:

```cpp
userdir.resolve("C:\\Users\\Admin\\secret.txt");
```

As a result, they get the path: `C:\Users\Admin\secret.txt`\. Thus, the lack of input validation allows attackers to access any file on the system\. For more details about path traversal attacks and their descriptions, refer to the official [OWASP website](https://owasp.org/www-community/attacks/Path_Traversal)\.

To protect against path traversal attacks, ensure the target path remains within the base directory\. In the example above, it is recommended to use the `normalize()` method to convert the path into its original form—resolving relative traversals like `..` and `.`, and redundant separators\. 

After that, the path should be validated via `startsWith(userdir)`\. This prevents access to files outside the target directory, even if the path contains masked relative traversals like `someFolder\..\..\..\admin\userInfo.xml`\.

```cpp
HttpServletRequest request;
HttpServletResponse response;

void write(Path userdir) throws IOException {

    ....

    String userFileRelativePath = request.getParameter("relativePath");

    Path fullPath = userdir.resolve(userFileRelativePath);
    
    if (fullPath.normalize().startsWith(userdir)) {
        String content = Files.readString(fullPath);

        ....

        response.getWriter().write(content);
    } else {
        ....
    }
}
```