Question

How can null byte injection be done on a java webapp, Or rather – how does on protect against it?

Should I look at each byte of the request parameter and inspect its ‘byte’ value to be 0 ? I can’t imagine a 0 byte sneaking in a request parameter… can it?

My main aim is to make sure the filename used for saving the file is safe enough. And for now, I am not looking answers that recommend (for example): replacing ALL non-word characters with Underscore.

Answer 1

Allowing the user to store files with arbitrary names is dangerous. What happens if the user provides "../../../WINDOWS/explorer.exe"? You should restrict filenames to only contain characters known to be harmless.

'\0' is not known to be harmless. As far as Java is concerned, '\0' is a character like any other. However, the operating system is likely to interpret '\0' as the end of a string. If a string is passed from Java to the operating system, that different interpretation could result in exploitable bugs. Consider:

if (filename.endsWith(".txt") {
    store(filename, data);
}

where filename is “C:\Windows\explorer.exe\0.txt”, which ends with “.txt” to Java, but with “.exe” to the operating system.