Fortify漏洞Path Manipulation

今天來聊聊Fortify漏洞的Path Manipulation部分,當發生以下兩種情況的時候，會產生 path manipulation 錯誤：

1.攻擊者能夠指定檔案系統操作中所使用的路徑。

2.攻擊者可藉由指定資源來取得一般情況下不被允許的權限。

產生問題:

1.[路徑暴露]

2.[被篡改的可能性]

預防方法:

轉寫白名單+黑名單:

Public Function cleanString(ByVal aString As String) As String

        If aString Is Nothing Then Return Nothing

        Dim cleanS As String = ""

        For i As Integer = 0 To aString.Length() - 1

            cleanS += cleanChar(Left(aString, i))

        Next

        Return cleanS

    End Function

    Private Shared Function cleanChar(ByVal aChar As Char) As Char

        '0-9

        For i As Integer = 48 To 58 - 1

            If Asc(aChar) = i Then Return ChrW(i)

        Next

        'A-Z

        For i As Integer = 65 To 91 - 1

            If Asc(aChar) = i Then Return ChrW(i)

        Next

        'a-z

        For i As Integer = 97 To 123 - 1

            If Asc(aChar) = i Then Return ChrW(i)

        Next

        Select Case aChar

            Case "/"

                Return "/"

            Case "."

                Return "."

            Case "-"

                Return "-"

            Case "_"

                Return "_"

            Case " "

                Return " "

        End Select

        Return "%"

    End Function

End Class

參考資料:http://b00.tw/xX4cF