A web application reads and displays a file by joining a file name given in a URL parameter to the name of its public folder. If a value containing ../ is given as the file name, configuration files and other files outside the public folder can be read. Which combination correctly gives the name of this attack and a countermeasure?

Answer: C. Directory traversal. Design the application so file names cannot be specified directly from outside, or normalize the path and confirm it lies inside the public folder

Directory traversal (path traversal) is an attack that uses symbols meaning "one directory up," such as ../, to read or overwrite files outside the folder the application intended. The cause is using a value received from outside directly as a file path. The first countermeasure is a design in which file names are not specified directly from outside and the server picks the file from a fixed number or ID. If external values must be used, normalize the path (resolving ../ and similar) and check that the result lies inside the permitted folder. In addition, minimizing the privileges of the account that runs the application to limit which files it can read keeps damage small if something goes wrong. Longer file names do not change the fact that ../ can be used to leave the folder.

• A. Reading files outside a folder with ../ is not XSS and cannot be prevented by escaping.
• B. The name is correct, but longer file names do not stop ../ from leaving the folder.
• C. Correct. Either avoid building paths from external values, or confirm that the normalized path lies inside the permitted folder.