Back to success stories

Sample of Defect

Project Name CID Checker Category Developer Description
FenixEdu/fenixedu-academic 94425 PATH_MANIPULATION High impact security Allowing users to specify a file to be downloaded in the Application Server's file system, leading to information leakage.
File: /src/main/java/org/fenixedu/academic/ui/struts/action/person/UploadPhotoDA.java 
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142

        if (photo.getRawSize() > MAX_RAW_SIZE) {
            actionMessages.add("fileTooLarge", new ActionMessage("errors.fileTooLarge"));
            saveMessages(request, actionMessages);
            photo.deleteTemporaryFiles();
            return prepare(mapping, actionForm, request, response);
        }

        try {
            photo.processImage();
        } catch (UnableToProcessTheImage e) {
            actionMessages.add("unableToProcessImage", new ActionMessage("errors.unableToProcessImage"));
            saveMessages(request, actionMessages);
            photo.deleteTemporaryFiles();
            return prepare(mapping, actionForm, request, response);
        }
        photo.createTemporaryFiles();

        request.setAttribute("preview", true);
        request.setAttribute("photo", photo);
        return mapping.findForward("confirm");
    }

    public ActionForward preview(ActionMapping mapping, ActionForm actionForm, HttpServletRequest request,
            HttpServletResponse response) throws Exception {
 
 << 1. "javax.servlet.ServletRequest.getParameter(java.lang.String)" returns data from a servlet request.
143

        String filename = request.getParameter("file");
 
 <<< CID 94425: High impact security PATH_MANIPULATION
 <<< 2. Constructing a path using the tainted value "filename". This may allow an attacker to access, modify, or test the existence of critical or sensitive files.
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170

        FileInputStream file = new FileInputStream(filename);
        DataOutputStream output = new DataOutputStream(response.getOutputStream());
        output.write(ByteStreams.toByteArray(file));
        output.close();
        return null;
    }

    public ActionForward save(ActionMapping mapping, ActionForm actionForm, HttpServletRequest request,
            HttpServletResponse response) throws Exception {
        PhotographUploadBean photo = getRenderedObject();
        RenderUtils.invalidateViewState();

        UploadOwnPhoto.run(ByteStreams.toByteArray(photo.getFileInputStream()),
                ContentType.getContentType(photo.getContentType()));
        final Person person = Authenticate.getUser().getPerson();
        request.setAttribute("personBean", new PersonBean(person));
        EmergencyContactBean emergencyContactBean = new EmergencyContactBean(person);
        request.setAttribute("emergencyContactBean", emergencyContactBean);
        return mapping.findForward("visualizePersonalInformation");
    }

    public ActionForward cancel(ActionMapping mapping, ActionForm actionForm, HttpServletRequest request,
            HttpServletResponse response) throws Exception {
        request.setAttribute("personBean", new PersonBean(AccessControl.getPerson()));
        request.setAttribute("emergencyContactBean", new EmergencyContactBean(AccessControl.getPerson()));
        return mapping.findForward("visualizePersonalInformation");
    }
Events:
1. tainted_source UploadPhotoDA.java:143
1. tainted_source UploadPhotoDA.java:143
1. tainted_source UploadPhotoDA.java:143
2. sink UploadPhotoDA.java:144
2. sink UploadPhotoDA.java:144
2. sink UploadPhotoDA.java:144

About Synopsys

Communities and resources