Skip to main content

Insecure functionality - File Creation

Need​

Secure functionality - File Creation

Context​

  • Usage of Java for building cross-platform applications
  • Usage of javax.servlet for building Java web applications with Servlet technology
  • Usage of java.io for input and output operations in Java

Description​

Non compliant code​

import javax.servlet.*;
import javax.servlet.http.*;
import java.io.*;

public class FileCreationServlet extends HttpServlet {

    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        String fileName = request.getParameter("fileName");
        String content = request.getParameter("content");
        
        // Assume that the user has been authenticated and the profile restrictions have been checked on the front end
        // Therefore, no server-side validation is performed
        File file = new File(fileName);
        if (!file.exists()) {
            file.createNewFile();
        }
        
        FileWriter writer = new FileWriter(file);
        writer.write(content);
        writer.close();
    }
}

The above code demonstrates a servlet in a Java backend application that handles file creation requests. The doPost method retrieves the file name and content from the HTTP request parameters and creates a new file with the given name and content.

However, this code is vulnerable due to the lack of server-side validation of user permissions. The assumption here is that the user has been authenticated and their profile restrictions have been checked on the front end. Therefore, no server-side validation is performed before creating the file.

This is a security vulnerability because a malicious user could bypass the front-end restrictions by directly sending a POST request to the server. Since there are no server-side checks, the server would process this request and create the file, even though the user's profile should restrict them from performing this action.

To fix this vulnerability, we should add server-side validation to check the user's profile restrictions before processing the file creation request.

Steps​

  • Perform server-side validation to ensure that the user has the necessary permissions to create a file.
  • Implement proper input validation to prevent any malicious input from being processed.
  • Use a secure file naming convention to prevent any directory traversal attacks.
  • Consider using a secure file storage location to prevent unauthorized access to the created files.
  • Implement proper error handling to provide meaningful error messages to the user.

Compliant code​

import javax.servlet.*;
import javax.servlet.http.*;
import java.io.*;
import java.nio.file.Paths;

public class FileCreationServlet extends HttpServlet {

    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        String fileName = request.getParameter("fileName");
        String content = request.getParameter("content");
        
        // Get the user's role from the session
        HttpSession session = request.getSession();
        String role = (String) session.getAttribute("role");

        // Validate the user's role
        if (!"admin".equals(role)) {
            response.sendError(HttpServletResponse.SC_FORBIDDEN, "You do not have permission to create a file.");
            return;
        }

        // Validate the file name
        if (fileName == null || fileName.trim().isEmpty()) {
            response.sendError(HttpServletResponse.SC_BAD_REQUEST, "Invalid file name.");
            return;
        }

        // Prevent directory traversal attacks
        String safeFileName = Paths.get(fileName).getFileName().toString();

        // Create the file in a secure location
        File file = new File("/secure/location/" + safeFileName);
        if (!file.exists()) {
            file.createNewFile();
        }
        
        FileWriter writer = new FileWriter(file);
        writer.write(content);
        writer.close();
    }
}

The updated code includes server-side validation to ensure that the user has the necessary permissions to create a file. This is done by checking the user's role, which is stored in the session. If the user is not an admin, a 403 Forbidden error is returned.

The file name provided by the user is also validated. If the file name is null or empty, a 400 Bad Request error is returned.

To prevent directory traversal attacks, the file name is sanitized using the Paths.get(fileName).getFileName().toString() method. This ensures that only the file name is used, without any directory information.

The file is created in a secure location (/secure/location/). This prevents unauthorized access to the created files.

Finally, the content provided by the user is written to the file. If any error occurs during this process, an appropriate error message is returned to the user.

References​

Last updated on