CWE 73 文件名或路径的外部控制
我正在努力修复 Veracode 漏洞 CWE-73 (https://cwe.mitre.org /data/definitions/73.html) 对于我的应用程序，其中输入文件名是由我们的其他应用程序动态发送的，它以 abc、xyz 等静态名称开头，但完整文件名通常为abc_1234567.txt。
现有应用程序代码片段： 调用方法A（输入目录，输入文件，X，Y）-> veracode 正在报告输入文件，在这种情况下，
我尝试添加条件来检查文件的扩展名、模式白名单以包含字母数字和其他通常的验证，例如文件字符串是否有效/非空 - 到目前为止没有运气，也通过了 Veracode 链接下面也是如此。 https://community.veracode.com/s/article/how-do-i-fix-cwe-73-external-control-of-file-name-or-path-in-java< /a>
文件名的硬编码是不可能的，因为我提到它是动态的，而且问题不仅仅在于扩展名。
我确实尝试与 ESAPI 集成以查看 getValidFileName 是否可以工作，但看起来这也不满足 veracode。
我可以进一步尝试查看的任何建议或指示都会有所帮助。！谢谢。
I am working to fix Veracode vulnerability CWE-73 (https://cwe.mitre.org/data/definitions/73.html) for my application in which the input filename is dynamically sent by our other application it starts with static names like abc, xyz but full file name usually like abc_1234567.txt.
Snippet of existing app code:
call methodA(inputdirectory, inputfile, X, Y) -> veracode is reporting for inputfile in this case
I have attempted to add condition to check extension of the file, pattern whitelist to have alphanumeric and other usually validation like file String is valid/Non-Empty - so far no luck and also went through Veracode link below as well.
https://community.veracode.com/s/article/how-do-i-fix-cwe-73-external-control-of-file-name-or-path-in-java
Hardcoding of file name is not possible as I mentioned it is dynamic and also the problem is not just with extension.
I did attempt to integrate with ESAPI to see if getValidFileName will work but looks like that is also not satisfying the veracode.
Any suggestions or pointers which I can attempt further to see will be helpful.! Thanks.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
CWE 73 是一种利用，攻击者提供用户输入，允许系统读取该文件并提供恶意访问。
问题的根源就是“动态”发送过来的。如果有时间，我会创建一个监狱或间接的。我们将服务器称为A，将客户端称为B。如果服务器发送ABC，则在客户端中映射ABC->DEF。并且基于查找，每当服务器发送ABC（检查他是否有ABC），然后基于DEF进行查找。切勿直接使用客户的用户输入。
CWE 73 is exploitation where the attacker provides a user input that allows the system to read the said file and provide malicious access.
The origin of the problem is the "dynamically" sent over. If given the time, I would create a jail or indirection. Let us call Server as A and Client as B. If the server sends ABC, map ABC->DEF in the client. And based on the lookup, whenever the server sends ABC (check whether he has ABC), then lookup based on DEF. Never directly consume the user input from the customer.