I have a table where the machine name, directory path and filenames are stored; when requested, I am supposed to return the content of the file by concatenating the machine_name + '\' + directory_path + '\' + filename but this gets listed as a directory traversal vulnerability. While I see that database table is treated a tainted source, I am wondering how to resolve this situation. I tried to RandomAccessReferenceMap from ESAPI, it works if I swap direct and indirect references but I would like to know if there is any other standard way of forming the paths from the database tables.

1 Answer 1


If the database is considered a tainted source (which makes sense e.g. if you want to defend against changes in the database performed by SQL injection), you need to follow the standard procedure to sanitize the contents. So you should verify that the machine name contains only allowed characters (and if the dot is allowed: that it does not contain consecutive dots), that the directory path does not contain '/../', start with '../' or ends with '/..' (maybe also stricter validation) and that the file name at least does not contain any slashes.

You likely should read about path traversal attacks and recommended validation and sanitization policies for file and path names instead of blindly following my suggestion, as they are just what occurred to me as minimum requirements.

  • I have read the Information that you have provided over the web and in OWASP; Right now, I have been trying various options of whitelisting. For local files, I could use ESAPI.validator.getValidFilename, getValidDirectory and getValidInput. Now, trying to whitelist the remote file names. Mar 17, 2018 at 12:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .