12

From the Area51 proposal

1
  • Also directory traversal attacks. Remember to use whitelists (better avoid any kind of trusting of untrustworthy data). Commented Nov 22, 2010 at 17:02

3 Answers 3

15

Accordingly to the following resources:

we can conclude that Null Byte injections are possible in Java.

2
  • 2
    As Dave Wichers' answer, this is historically correct for OpenJDK until 2013. Now fixed, that's not to say you shouldn't, say, whitelist characters in filenames. Commented Sep 12, 2014 at 17:44
  • It's "according to" ... anything below a 6 character edit won't go through though. So perhaps someone seeing this comment will fix it and flag my comment for deletion. Thanks. Commented May 24, 2020 at 18:47
8

Null byte injection depends on a mismatch in the way that strings are handled.

e.g. Java stores the length of the string independently of the content of the string, while C starts at the beginning of the string and checks for a Null Byte to indicate the end of the string.

As a result, Java code can perform checks like "does the file requested end with .jsp" on a string like "/etc/shadow%00.jsp" (where %00 represents the null byte), and return true, while passing this string to "new FileInputStream()" will result in the underlying OS (both Windows and Linux) trying to open "/etc/shadow".

(Relevance of trying to open /etc/shadow on Windows is left as an exercize for the reader :-) )

7

Null byte injection in filenames was fixed in Java 7 update 40 (released around Sept. 2013), https://bugs.java.com/bugdatabase/view_bug.do?bug_id=8014846 . So, its FINALLY fixed.

3
  • 1
    Wow, thanks for the update Dave. Can you provide a link, and some more technical details?
    – AviD
    Commented Sep 11, 2014 at 8:11
  • @AviD Do you want to change the accepted answer? bugs.java.com/bugdatabase/view_bug.do?bug_id=8014846 Commented Sep 12, 2014 at 17:49
  • 1
    Sure, if you want to expand this in to a proper answer... :-)
    – AviD
    Commented Sep 14, 2014 at 8:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .