Question

I have a Java web application that has functionality to fetch remote files using URL.

While I was testing the code I found out that it is possible for an anonymous user to read a local file by modifying the path of the file, /etc/passwd, to file URL schema, file:///etc/passwd, and the file will be read by URL, here is an example:

String remoteUrl = "file:///etc/passwd"; // some url we got from anonymous user
URL url = new URL(remoteUrl);
byte data[] = new byte[1024];
int length;

BufferedInputStream inputStream = new BufferedInputStream(url.openStream());

ServletOutputStream outputStream = response.getOutputStream();
// OR PrintStream outputStream = System.out;

while( (length = inputStream.read(data, 0, 1024)) >= 0 ) {
    outputStream.write(data, 0, length);
}

Any suggestions on fixing this issue?

Answer 1

If your using URL, you can get the protocol from it. In that case you can just throw an exception if the protocol is “file” (or is not “http” depending on how restrictive you want to make it)