使用检查玛克斯工具在代码扫描期间获取检查马克思路径遍历问题

Question

在执行 HttpWeb 请求时获取检查火星路径遍历问题，

checkmarx的错误消息:从headers元素获取动态数据。然后，这个元素的值流经代码，最终用于本地磁盘访问的文件路径。

我在标头中传递的唯一输入是用于访问 API 的令牌。有没有办法克服这个问题？

下面是代码，我从cookie中获取令牌，并将其与httpRequest一起传递。

Dim responseString As String = ExecuteURL("www.mysite.com\action")

Private Function ExecuteURL(ByVal url As String) As String

        Dim basicRequest As HttpWebRequest = DirectCast(WebRequest.Create(url), HttpWebRequest)
        basicRequest.ContentType = "application/json; charset=utf-8"
        basicRequest.Method = "GET"

        Dim cookie As HttpCookie = HttpContext.Current.Request.Cookies("token")
        If Not cookie Is Nothing AndAlso Not String.IsNullOrEmpty(cookie.Value) Then
            basicRequest.Headers.Add("Authorization", "service" + cookie.Value)
        End If
        Dim response As HttpWebResponse
        Try
            response = CType(basicRequest.GetResponse(), HttpWebResponse)
            If Not response Is Nothing Then
                Using streamReader As StreamReader = New StreamReader(response.GetResponseStream())
                    Return streamReader.ReadToEnd()
                End Using
            End If
        Catch ex As System.Net.WebException
            Using streamReader As StreamReader = New StreamReader(ex.Response.GetResponseStream())
                Return streamReader.ReadToEnd()
            End Using
        End Try

        Return String.Empty
    End Function

Answer 1

这也是owasp中提到的漏洞之一。为了更好地理解和解决问题，我建议阅读以下内容:https://blog . thoughten security . com/2018/10/how-to-prevent-path-traversal-in-net . html