Path Traversal

/* path_traversal.c */
/* Cegah path traversal: tolak "..", gunakan realpath() + cek prefix. */
#define _XOPEN_SOURCE 500
#define _POSIX_C_SOURCE 200809L
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <limits.h>
#include <errno.h>

#define BASE_DIR "/tmp/safe_app_data_12a"

/* Cek sederhana: tolak ".." dalam path. */
static int has_traversal(const char *path) {
    if (path == NULL) return 1;
    if (strstr(path, "..") != NULL) return 1;
    if (path[0] == '/') return 1; /* tolak absolute path */
    return 0;
}

/* Validasi lengkap: gabungkan dengan base, resolve, lalu cek prefix. */
static int validate_path(const char *user_path, char *resolved, size_t resolved_size) {
    if (has_traversal(user_path)) {
        fprintf(stderr, "[REJECT] path mengandung pola traversal: '%s'\n", user_path);
        return 0;
    }

    char full[PATH_MAX];
    int n = snprintf(full, sizeof full, "%s/%s", BASE_DIR, user_path);
    if (n < 0 || (size_t)n >= sizeof full) {
        fprintf(stderr, "[REJECT] path terlalu panjang\n");
        return 0;
    }

    /* realpath menulis path absolut kanonik ke real (bila ada filenya). */
    char real[PATH_MAX];
    if (realpath(full, real) == NULL) {
        fprintf(stderr, "[REJECT] realpath gagal: %s\n", strerror(errno));
        return 0;
    }

    /* Cek prefix: pastikan resolved ada di dalam BASE_DIR. */
    size_t base_len = strlen(BASE_DIR);
    if (strncmp(real, BASE_DIR, base_len) != 0) {
        fprintf(stderr, "[REJECT] resolved di luar base: '%s'\n", real);
        return 0;
    }
    /* Pastikan karakter setelah prefix adalah '/' atau akhir string. */
    if (real[base_len] != '/' && real[base_len] != '\0') {
        fprintf(stderr, "[REJECT] prefix tidak lengkap: '%s'\n", real);
        return 0;
    }

    snprintf(resolved, resolved_size, "%s", real);
    return 1;
}

int main(void) {
    /* Jaga urutan output: stdout tidak di-buffer supaya selaras dengan stderr. */
    setvbuf(stdout, NULL, _IONBF, 0);

    /* Buat direktori base dan file uji untuk realpath(). */
    char cmd[256];
    snprintf(cmd, sizeof cmd, "mkdir -p %s", BASE_DIR);
    system(cmd);
    snprintf(cmd, sizeof cmd, "touch %s/file_a.txt", BASE_DIR);
    system(cmd);
    snprintf(cmd, sizeof cmd, "mkdir -p %s/sub", BASE_DIR);
    system(cmd);

    const char *inputs[] = {
        "file_a.txt",          /* valid */
        "sub/file_b.txt",      /* tidak ada, realpath gagal */
        "../etc/passwd",       /* traversal */
        "/etc/passwd",         /* absolute path */
        "sub/../file_a.txt",   /* setelah resolve valid */
    };
    const size_t n = sizeof(inputs) / sizeof(inputs[0]);

    for (size_t i = 0; i < n; i++) {
        char resolved[PATH_MAX];
        printf("--- Test %zu: '%s' ---\n", i + 1, inputs[i]);
        if (validate_path(inputs[i], resolved, sizeof resolved)) {
            printf("[ACCEPT] resolved = '%s'\n", resolved);
        }
    }
    return 0;
}

--- Test 1: 'file_a.txt' ---
[ACCEPT] resolved = '/tmp/safe_app_data_12a/file_a.txt'
--- Test 2: 'sub/file_b.txt' ---
[REJECT] realpath gagal: No such file or directory
--- Test 3: '../etc/passwd' ---
[REJECT] path mengandung pola traversal: '../etc/passwd'
--- Test 4: '/etc/passwd' ---
[REJECT] path mengandung pola traversal: '/etc/passwd'
--- Test 5: 'sub/../file_a.txt' ---
[REJECT] path mengandung pola traversal: 'sub/../file_a.txt'

/* extra_path_traversal.c — allow-list nama file sederhana. */
#include <stdio.h>
#include <string.h>
#include <ctype.h>

static int is_safe_filename(const char *name) {
    if (name == NULL || *name == '\0') return 0;
    size_t len = strlen(name);
    if (len > 255) return 0;
    for (size_t i = 0; i < len; i++) {
        char c = name[i];
        if (!(isalnum((unsigned char)c) || c == '.' || c == '_' || c == '-')) {
            return 0;
        }
    }
    if (strstr(name, "..") != NULL) return 0;
    if (name[0] == '.') return 0;
    return 1;
}

int main(void) {
    const char *tests[] = {
        "file.txt",
        "report_2024.csv",
        "../etc/passwd",
        "file.txt;rm -rf /",
        "file name.txt",
        ".hidden",
        "ok-file_v1.dat",
    };
    const size_t n = sizeof(tests) / sizeof(tests[0]);
    for (size_t i = 0; i < n; i++) {
        printf("[%s] '%s'\n",
               is_safe_filename(tests[i]) ? "ACCEPT" : "REJECT",
               tests[i]);
    }
    return 0;
}

[ACCEPT] 'file.txt'
[ACCEPT] 'report_2024.csv'
[REJECT] '../etc/passwd'
[REJECT] 'file.txt;rm -rf /'
[REJECT] 'file name.txt'
[REJECT] '.hidden'
[ACCEPT] 'ok-file_v1.dat'

char tmpl[] = "/tmp/app_XXXXXX";
char *dir = mkdtemp(tmpl);
if (dir == NULL) { /* error */ }