A Simple and Intuitive Algorithm for Preventing Directory Traversal Attacks

With web applications becoming a preferred method of presenting graphical interfaces to users, software vulnerabilities affecting web applications becoming more and more prevalent and devastating. Some of these, such as directory traversal attacks, have varying defense and mitigations that can be difficult to understand, analyze, and. Gaps in the testing of these directory traversal defense mechanisms can to vulnerabilities that allow attackers to read sensitive data from files even execute malicious code. This paper presents an analysis of some used directory traversal attack defenses and presents a new,-based algorithm to help prevent these attacks by safely canonicalizing-supplied path strings. The goal of this algorithm is to be small, easy to, cross-platform compatible, and above all, intuitive. We provide a proof correctness and verification strategies using symbolic execution for the. We hope that the algorithm is simple and effective enough to help developers towards a unified defense against directory traversal attacks.