Weaknesses in this category can be used to access files outside
of a restricted directory (path traversal) or to perform operations on files
that would otherwise be restricted (path equivalence).
Extended Description
Files, directories, and folders are so central to information technology
that many different weaknesses and variants have been discovered. The
manipulations generally involve special characters or sequences in
pathnames, or the use of alternate references or channels.
Applicable Platforms
Languages
All
Potential Mitigations
Phase
Description
Assume all input is malicious. Use an appropriate combination of black
lists and white lists to ensure only valid and expected input is
processed by the system.
Description
