使用checkMarx工具在代码扫描过程中获取checkMarx路径遍历问题

Question

在执行checkMarx路径遍历问题时获取HttpWebRequest，

来自checkmarx的错误消息:从headers元素获取动态数据。然后，该元素的值在代码中流动，并最终用于本地磁盘访问的文件路径中。

我在报头中传递的唯一输入是访问API的令牌。有没有办法解决这个问题？

下面是代码，我从cookie中获取令牌，并将其与httpRequest一起传递。

Dim responseString As String = ExecuteURL("www.mysite.com\action")

Private Function ExecuteURL(ByVal url As String) As String

        Dim basicRequest As HttpWebRequest = DirectCast(WebRequest.Create(url), HttpWebRequest)
        basicRequest.ContentType = "application/json; charset=utf-8"
        basicRequest.Method = "GET"

        Dim cookie As HttpCookie = HttpContext.Current.Request.Cookies("token")
        If Not cookie Is Nothing AndAlso Not String.IsNullOrEmpty(cookie.Value) Then
            basicRequest.Headers.Add("Authorization", "service" + cookie.Value)
        End If
        Dim response As HttpWebResponse
        Try
            response = CType(basicRequest.GetResponse(), HttpWebResponse)
            If Not response Is Nothing Then
                Using streamReader As StreamReader = New StreamReader(response.GetResponseStream())
                    Return streamReader.ReadToEnd()
                End Using
            End If
        Catch ex As System.Net.WebException
            Using streamReader As StreamReader = New StreamReader(ex.Response.GetResponseStream())
                Return streamReader.ReadToEnd()
            End Using
        End Try

        Return String.Empty
    End Function

Answer 1

这也是owasp中提到的漏洞之一。为了更好地理解和解决问题，我建议阅读一下这个- https://blog.mindedsecurity.com/2018/10/how-to-prevent-path-traversal-in-net.html。