引入方式
Implementation
适用平台
编程语言
类： Not Language-Specific (Undetermined)
技术
类： Not Technology-Specific (Undetermined)
常见后果
| 影响范围 |
影响 |
可能性 |
| Access Control | Bypass Protection Mechanism | |
观察示例
| 参考资料 |
描述 |
| "/.////" in pathname collapses to absolute path. |
| "/.//..//////././" is collapsed into "/.././" after ".." and "//" sequences are removed. |
| ".../...//" collapsed to "..." due to removal of "./" in web server. |
| Chain: HTTP server protects against ".." but allows "." variants such as "////./../.../". If the server removes "/.." sequences, the result would collapse into an unsafe value "////../" (CWE-182). |
| Chain: ".../...//" bypasses protection mechanism using regexp's that remove "../" resulting in collapse into an unsafe value "../" (CWE-182) and resultant path traversal. |
| XSS protection mechanism strips a
|
