Skip to content

Instantly share code, notes, and snippets.

@mdabir1203
Created April 12, 2024 10:16
Show Gist options
  • Save mdabir1203/94cabfc32f85a6726fb236e3e5cf7d0c to your computer and use it in GitHub Desktop.
Save mdabir1203/94cabfc32f85a6726fb236e3e5cf7d0c to your computer and use it in GitHub Desktop.
class PathTraversalSanitizer
{
@MethodHook(type = HookType.AFTER, targetClassName = "java.io.File", targetMethod = "<init>", targetMethodDescriptor = "(Ljava/lang/String;)")
public static void fileConstructorHook(MethodHandle method, Object thisObject, Object[] arguments, int hookId, Object returnValue)
{
File file = (File) thisObject;
String pathname = (String) arguments[0];
try
{ // Check whether the canonical path of `file` lies inside a known list of allowed paths.
if (!file.getCanonicalPath().startsWith("/expected/path"))
{ // If not, throw a distinctive exception that is reported by Jazzer. throw new PotentialPathTraversalException(); } }
catch(IOException e) { } }
@mdabir1203
Copy link
Author

image

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment