What would be some security implications of a fixed pathname (although probably in a system directory when it would be deployed as a system service) rather than a relative (out of current directory)? If the answer is "it depends", how so?

  • 3
    I think this issue is well explain by the wiki page : owasp.org/www-community/attacks/Path_Traversal – mootmoot Nov 11 '20 at 22:25
  • Will look into this! thanks a lot! – Isaac Seo Nov 12 '20 at 23:37
  • This question could use a bit more context. Are you talking about paths in the URL of a web app? Are you talking about file system paths when a script or service is reading a file or calling another script or service? – Mike Ounsworth Dec 8 '20 at 2:53

In general: an absolute path name is more clear than a relative one. It is not open to interpretation based on the context like a relative path name is. The actual meaning of a relative name depends on the current directory, on environment variables (like PATH) etc, while an absolute path name most times means the same thing.

Therefore an absolute path name is almost always the more secure choice. Of course one is probably able to deliberately construct some scenario where the absolute path is the more insecure choice and likely there will be even such scenarios out there in the wild - developers are often creative in inventing their own approaches of how things should work and of ignoring established ones.

There is one scenario I could think of though, where a relative name can be less ambivalent: if chroot or similar things are used, then for example a symlink using an absolute path can result in a different target file inside and outside the chroot, while a symlink using a relative path might still point to the same file. And this difference might actually result in a security issue.

  • Hey! Thanks for the detailed answer! Appreciate it! – Isaac Seo Nov 12 '20 at 23:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.