Add additional example.

Author: Max Schaefer

java/ql/src/Security/CWE/CWE-022/TaintedPath.qhelp

@@ -46,6 +46,11 @@ not contain ".." and starts with the public folder.</p>
 
 <sample src="TaintedPathGood.java" />
 
+<p>Alternatively, if we only want to allow simple filenames without a path component, we can remove all path
+separators ("/" or "\") and all ".." sequences from the input before using it to construct a file path.</p>
+
+<sample src="TaintedPathGood2.java" />
+
 </example>
 <references>
 

java/ql/src/Security/CWE/CWE-022/TaintedPathGood2.java

@@ -0,0 +1,13 @@
+public void sendUserFileGood(Socket sock, String user) {
+	BufferedReader filenameReader = new BufferedReader(
+			new InputStreamReader(sock.getInputStream(), "UTF-8"));
+	String filename = filenameReader.readLine();
+	// GOOD: remove all ".." sequences and path separators from the filename
+	filename = filename.replaceAll("\\.\\.|[/\\\\]", "");
+	BufferedReader fileReader = new BufferedReader(new FileReader(filename));
+	String fileLine = fileReader.readLine();
+	while(fileLine != null) {
+		sock.getOutputStream().write(fileLine.getBytes());
+		fileLine = fileReader.readLine();
+	}
+}

java/ql/test/query-tests/security/CWE-022/semmle/tests/TaintedPath.java

@@ -32,4 +32,17 @@ public void sendUserFileGood(Socket sock, String user) throws IOException {
             }
         }
     }
+
+    public void sendUserFileGood2(Socket sock, String user) throws IOException {
+        BufferedReader filenameReader = new BufferedReader(new InputStreamReader(sock.getInputStream(), "UTF-8"));
+        String filename = filenameReader.readLine();
+        // GOOD: remove all ".." sequences and path separators from the filename
+        filename = filename.replaceAll("\\.\\.|[/\\\\]", "");
+        BufferedReader fileReader = new BufferedReader(new FileReader(filename));
+        String fileLine = fileReader.readLine();
+        while(fileLine != null) {
+            sock.getOutputStream().write(fileLine.getBytes());
+            fileLine = fileReader.readLine();
+        }
+    }
 }