How to Implement Upward Path Traversal Filtering in Java or Scala?

What are the best practices for implementing upward path traversal filtering in Java or Scala?

// Sample code in Java
public boolean isValidPath(String path) {
    // Check for upward traversal
    return !path.contains("../");
}

Upward path traversal can pose a security risk when an application allows users to navigate outside of a designated directory. This answer provides best practices for filtering such traversals in both Java and Scala, ensuring applications remain safe and secure by validating user inputs properly.

// Sample Scala code for path filtering
def isValidPath(path: String): Boolean = {
    !path.contains("../") 
}

Causes

• User inputs that contain the substring '../' allow navigation to parent directories.
• Insufficient validation of file paths can lead to directory traversal attacks.

Solutions

• Parse the input paths and ensure they don't contain any patterns indicative of upward traversal (like '../').
• Utilize libraries that provide secure file handling, which prevents unintended directory access.
• Implement regular expressions to strictly match allowed file structures.

Mistake: Not normalizing paths before validation.

Solution: Always normalize user-provided paths using methods to resolve symbolic links or similar constructs.

Mistake: Relying solely on blacklist approaches (like checking for '../').

Solution: Implement a whitelist approach by defining allowed paths instead of just blocking illegal ones.