I’m looking for a way to prevent directory traversal attacks, specifically those involving the ../ pattern in file paths, at the Java Runtime Environment (JRE) level. My goal is to ensure that such attacks are mitigated without relying on explicit path validation and sanitization checks in my Java code.
- Here is what I have observed:
Java Security Manager: While the SecurityManager can help with controlling file access, it does not directly prevent or sanitize paths that include ../ sequences.
File Permissions and Policies: Setting file permissions and security policies might restrict access but does not inherently sanitize paths to prevent directory traversal.
JRE Configuration: I’m aware that JRE configurations or system properties might provide some level of security, but I haven’t found specific options to prevent ../ patterns from being processed.
- My Questions:
-
Is there any built-in mechanism in the JRE to automatically prevent or sanitize file paths containing ../ patterns?
-
Are there JRE configurations, system properties, or settings that can help in mitigating directory traversal attacks at a lower level, without requiring code-level checks?
-
If no such mechanisms exist, what are the best practices for securing file paths at the JRE level, apart from application code checks?
I would appreciate any guidance or references to relevant documentation or tools that could help achieve this security goal at the JRE level.