From the Area51 proposal

  • Also directory traversal attacks. Remember to use whitelists (better avoid any kind of trusting of untrustworthy data). Nov 22 '10 at 17:02

Accordingly to the following resources:

we can conclude that Null Byte injections are possible in Java.

  • 2
    As Dave Wichers' answer, this is historically correct for OpenJDK until 2013. Now fixed, that's not to say you shouldn't, say, whitelist characters in filenames. Sep 12 '14 at 17:44
  • It's "according to" ... anything below a 6 character edit won't go through though. So perhaps someone seeing this comment will fix it and flag my comment for deletion. Thanks. May 24 '20 at 18:47

Null byte injection depends on a mismatch in the way that strings are handled.

e.g. Java stores the length of the string independently of the content of the string, while C starts at the beginning of the string and checks for a Null Byte to indicate the end of the string.

As a result, Java code can perform checks like "does the file requested end with .jsp" on a string like "/etc/shadow%00.jsp" (where %00 represents the null byte), and return true, while passing this string to "new FileInputStream()" will result in the underlying OS (both Windows and Linux) trying to open "/etc/shadow".

(Relevance of trying to open /etc/shadow on Windows is left as an exercize for the reader :-) )


Null byte injection in filenames was fixed in Java 7 update 40 (released around Sept. 2013), https://bugs.java.com/bugdatabase/view_bug.do?bug_id=8014846 . So, its FINALLY fixed.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.