Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

From the Area51 proposal

share|improve this question
Also directory traversal attacks. Remember to use whitelists (better avoid any kind of trusting of untrustworthy data). – Tom Hawtin - tackline Nov 22 '10 at 17:02
up vote 12 down vote accepted

Accordingly to the following resources:

we can conclude that Null Byte injections are possible in Java.

share|improve this answer
As Dave Wichers' answer, this is historically correct for OpenJDK until 2013. Now fixed, that's not to say you shouldn't, say, whitelist characters in filenames. – Tom Hawtin - tackline Sep 12 '14 at 17:44

Null byte injection depends on a mismatch in the way that strings are handled.

e.g. Java stores the length of the string independently of the content of the string, while C starts at the beginning of the string and checks for a Null Byte to indicate the end of the string.

As a result, Java code can perform checks like "does the file requested end with .jsp" on a string like "/etc/shadow%00.jsp" (where %00 represents the null byte), and return true, while passing this string to "new FileInputStream()" will result in the underlying OS (both Windows and Linux) trying to open "/etc/shadow".

(Relevance of trying to open /etc/shadow on Windows is left as an exercize for the reader :-) )

share|improve this answer

Null byte injection in filenames was fixed in Java 7 update 40 (released around Sept. 2013). So, its FINALLY fixed.

share|improve this answer
Wow, thanks for the update Dave. Can you provide a link, and some more technical details? – AviD Sep 11 '14 at 8:11
@AviD Do you want to change the accepted answer? – Tom Hawtin - tackline Sep 12 '14 at 17:49
Sure, if you want to expand this in to a proper answer... :-) – AviD Sep 14 '14 at 8:02

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.