Directory traversal is another injection-style attack, wherein a malicious user tricks filesystem code into reading and\/or writing files that the Web server shouldn\u2019t have access to. An example might be a view that reads files from the disk without carefully sanitizing the file name:<\/p>\n
def dump_file(request):
\nfilename = request.GET[“filename”]\nfilename = os.path.join(BASE_PATH, filename)
\ncontent = open(filename).read()
\n# …<\/p>\n
Though it looks like that view restricts file access to files beneath BASE_PATH (by using os.path.join), if the attacker passes in a filename containing .. (that\u2019s two periods, a shorthand for \u201cthe parent directory\u201d), she can access files \u201cabove\u201d BASE_PATH. It\u2019s only a matter of time before she can discover the correct number of dots to successfully access, say, ..\/..\/..\/..\/..\/etc\/passwd. Anything that reads files without proper escaping is vulnerable to this problem. Views that write files are just as vulnerable, but the consequences are doubly dire.
\nAnother permutation of this problem lies in code that dynamically loads modules based on the URL or other request information. A well-publicized example came from the world of Ruby on Rails. Prior to mid-2006, Rails used URLs like http:\/\/example.com\/person\/poke\/1 directly to load modules and call methods. The result was that a carefully constructed URL could automatically load arbitrary code, including a database reset script!<\/p>\n
The Solution<\/strong> – If your code ever needs to read or write files based on user input, you need to sanitize the requested path very carefully to ensure that an attacker isn\u2019t able to escape from the base directory you\u2019re restricting access to.<\/p>\n