Unsanitized use of FileUpload filename detected

Description

The unsanitized use of the filename provided by FileUpload could lead to path traversal attacks, since an attacker could manipulate the filename to gain access to unauthorized resources. Try to avoid referencing filenames that are open to such manipulation, or if it is unavoidable, ensure that the filename is sanitized and that appropriate validation measures are taken.

Remediations

❌ Avoid wherever possible

✅ Sanitize user input when resolving paths, for example by using FilenameUtils.getName() to normalize the path:

  ServletFileUpload upload = new ServletFileUpload();
List<FileItem> fileItems = upload.parseRequest(request);

for (FileItem item : fileItems) {
String filename = FilenameUtils.getName(item.getName());
// ...
}

Resources

Associated CWE

OWASP Top 10

Configuration

To skip this rule during a scan, use the following flag

bearer scan /path/to/your-project/ --skip-rule=java_lang_file_upload_filename

To run only this rule during a scan, use the following flag

bearer scan /path/to/your-project/ --only-rule=java_lang_file_upload_filename

Ready to take the next step? Learn more about Bearer Cloud.