Zennoxa Shield
Rules / Java
SHIELD-JAVA-011

Path Traversal via File Construction

highJavaCWE-22CVSS 7.5

What it detects

Constructing a File from request-derived input without validation enables path traversal.

How to fix

Canonicalize the path and verify it stays within an allowed base directory.

Vulnerable — Shield flags thisDownloadController.java
import java.io.File;
import javax.servlet.http.HttpServletRequest;

public class DownloadController {
    private static final String BASE_DIR = "/var/app/uploads";

    public File resolve(HttpServletRequest request) {
        return new File(BASE_DIR, request.getParameter("filename"));
    }
}
Fixed — scans cleanDownloadController.java
import java.io.File;
import java.io.IOException;
import java.nio.file.*;
import javax.servlet.http.HttpServletRequest;

public class DownloadController {
    private static final Path BASE_DIR = Paths.get("/var/app/uploads");

    public File resolve(HttpServletRequest request) throws IOException {
        Path requested = BASE_DIR.resolve(request.getParameter("filename")).normalize();
        if (!requested.startsWith(BASE_DIR)) {
            throw new SecurityException("path traversal attempt blocked");
        }
        return requested.toFile();
    }
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-JAVA-011, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-JAVA-011: Path Traversal via File Construction — Zennoxa Shield