Zennoxa Shield
Rules / Kotlin
SHIELD-KOTLIN-011

Path traversal via File/FileInputStream with request input

highKotlinCWE-22CVSS 7.5

What it detects

Constructing a File or FileInputStream from request-derived input allows path traversal outside the intended directory.

How to fix

Canonicalize the path and verify it stays within an allowed base directory before opening.

Vulnerable — Shield flags thisDownloadServlet.kt
import java.io.File
import javax.servlet.http.HttpServletRequest
import javax.servlet.http.HttpServletResponse

fun download(req: HttpServletRequest, resp: HttpServletResponse) {
    val file = File(req.getParameter("path"))
    file.inputStream().copyTo(resp.outputStream)
}
Fixed — scans cleanDownloadServlet.kt
import java.io.File
import javax.servlet.http.HttpServletRequest
import javax.servlet.http.HttpServletResponse

fun download(req: HttpServletRequest, resp: HttpServletResponse) {
    val base = File("/srv/app/files").canonicalFile
    val name = req.getParameter("path") ?: ""
    val requested = File(base, name).canonicalFile
    if (!requested.path.startsWith(base.path + File.separator)) {
        resp.sendError(400, "invalid path")
        return
    }
    requested.inputStream().copyTo(resp.outputStream)
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-KOTLIN-011, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-KOTLIN-011: Path traversal via File/FileInputStream with request input — Zennoxa Shield