Friday, December 14, 2012

The "File Separator" HP Fortify bug is REALLY easy to hack around.

This posting is bad. It was pointed out to me that the following is a better way to address this:

string unfinishedPath = "C:\\\\fun";
string attachmentPath = unfinishedPath + "\\";
if (Directory.Exists(attachmentPath))
{
   Directory.Delete(attachmentPath, true);
}

 
 

...and you can get around it like so:

string unfinishedPath = "C:\\\\fun";
string attachmentPath = unfinishedPath;
if (Directory.Exists(String.Format("{0}{1}",attachmentPath,
      Path.DirectorySeparatorChar.ToString())))
{
   Directory.Delete(String.Format("{0}{1}",attachmentPath,
         Path.DirectorySeparatorChar.ToString()));
}

No comments:

Post a Comment