引入方式
Implementation
適用平台
程式語言
類別： Not Language-Specific (Undetermined)
技術
類別： Not Technology-Specific (Undetermined)
常見後果
| 範圍 |
影響 |
可能性 |
| Access Control | Bypass Protection Mechanism | |
觀察到的案例
| 參考資料 |
描述 |
| "/.////" in pathname collapses to absolute path. |
| "/.//..//////././" is collapsed into "/.././" after ".." and "//" sequences are removed. |
| ".../...//" collapsed to "..." due to removal of "./" in web server. |
| Chain: HTTP server protects against ".." but allows "." variants such as "////./../.../". If the server removes "/.." sequences, the result would collapse into an unsafe value "////../" (CWE-182). |
| Chain: ".../...//" bypasses protection mechanism using regexp's that remove "../" resulting in collapse into an unsafe value "../" (CWE-182) and resultant path traversal. |
| XSS protection mechanism strips a
|
