Thursday, December 13, 2012

The "File Separator" HP Fortify bug is easy to hack around.

Something like this will give you the error:

string unfinishedPath = "C:\\\\fun";
string attachmentPath = unfinishedPath + "\\";
if (Directory.Exists(attachmentPath))
{
   Directory.Delete(attachmentPath, true);
}

 
 

...and you can get around it like so:

string unfinishedPath = "C:\\\\fun";
char seperator = (char)92;
List<char> characters = unfinishedPath.ToList();
characters.Add(seperator);
string attachmentPath = characters.Aggregate("", (current, c) => current + c.ToString());
if (Directory.Exists(attachmentPath))
{
   Directory.Delete(attachmentPath, true);
}

No comments:

Post a Comment