Sobelow v0.6.8 Sobelow.Misc.FilePath

Insecure use of File and Path

In Elixir, File methods are null-terminated, while Path functions are not. This may cause security issues in certain situations. For example:

user_input = "/var/www/secret.txt\0/name"

path = Path.dirname(user_input)
public_file = path <> "/public.txt"

File.read(public_file)

Because Path functions are not null-terminated, this will attempt to read the file, “/var/www/secret.txt\0/public.txt”. However, due to the null-byte termination of File functions “secret.txt” will ultimately be read.

File/Path checks can be ignored with the following command:

$ mix sobelow -i Misc.FilePath

Summary

Functions

details()
parse_def(fun)
run(fun, meta_file)