Java questions...

[Joe Testa <jst3290 () RITVAX ISC RIT EDU>]

Hi!

    I'm about to release the first version (v0.1) of a small Java
webserver I wrote, and I have some security-related concerns to
raise before I do.

    I know that a webserver should check to see if a requested document
is inside the webroot, but specifically, I'd like to know the safest
and most reliable way to accomplish this in Java.  Here is an excerpt
from my soon-to-be released code of how I currently implement it:


    private boolean isSafe( File requestedObject ) {


        boolean retVal = false;

        try {
            if ( (requestedObject.getCanonicalPath()).startsWith(
                                         webRoot.getCanonicalPath() ) )
                retVal = true;
        } catch( IOException e ) {
            retVal = false;
            continueFlag = false;
        }

        return retVal;


    }


    This method accepts a File object as a parameter.  This File
object, 'requestedObject', is constructed by appending the virtual path
(the user's input) to the web root.  'requestedObject' is checked to
see if its absolute path begins with the webroot.  If it is, the method
returns true, and false if otherwise.

    An interesting feature of Java's File class is that any double dots
("..") in its path are automatically translated.  For example, if
'requestedObject' contained the path:

      "c:\webroot\..\windows\repair\sam._", or
      "/usr/local/webroot/../../../etc/passwd",

calling the method, 'getCanonicalPath()' would return:

      "c:\windows\repair\sam._", and
      "/etc/passwd",

respectively.  I take advantage of this feature and use the String
class's 'startsWith()' method to check if the webroot prefixes
'requestedObject' after calling 'getCanonicalPath()'.

    In testing this code, I noticed that references may begin to leave
the webroot, but must finish inside it in order to pass the method.
For example, if the webroot is "c:\webroot", and the user sends,

        GET /../windows/../webroot/

then, 'requestedObject.getCanonicalPath()' would return "c:\webroot",
and everything is OK.  I wonder if there exist any weaknesses in Java's
File and String classes that could be exploited to subvert my
'isSafe()' method.  Maybe there is something that could mimick the
null-byte problem that PERL's 'open()' call has?  Any Java wizards have
any ideas?

    Btw, I'm being extra paranoid because I hope to release this server
to TuCows in the next few weeks.  So keep your eyes open for
"hellbent java webserver v0.1".  And don't post any vulnerabilities
you might find to BUGTRAQ until you tell me & I fix them.  =]

    Thanks a lot!

        - Joe Testa
          ( jst3290 () cs rit edu )