任意位置写入文件
Open
- Dominant language
- Java
- Stars
- 1.2k
- Forks
- 297
- PR merge metrics
- No merged PRs in 30d
Description
在如上代码地方，未对用户输入内容过滤，可以通过../../../../实现路径穿越，从而在任意位置写入文件
测试单位：山东大学网络空间安全学院
Contributor guide
No contributing guide indexed for this repository
Research direction
Start at the code shown in the attached screenshot and trace how the user-supplied path reaches the file-writing operation. Reproduce the reported ../../../../ traversal safely, then verify that paths are constrained to the intended location and that the existing behavior still works for valid input.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100