Skip to content

Fix path traversal in ProxyCredentialsModule #12

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
victor-nb wants to merge 1 commit into
base: main
Choose a base branch
from
+12 −1
Open

Fix path traversal in ProxyCredentialsModule #12

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 12 additions & 1 deletion ...cala/com/twitter/product_mixer/component_library/module/http/ProxyCredentialsModule.scala
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,18 @@
def providesProxyCredentials(
@Flag(HttpClientWithProxyCredentialsPath) proxyCredentialsPath: String,
): ProxyCredentials = {
val credentialsFile = new File(proxyCredentialsPath)
if (proxyCredentialsPath == null || proxyCredentialsPath.trim.isEmpty) {
throw MissingProxyCredentialsException
}

val credentialsFile = new File(proxyCredentialsPath).getCanonicalFile

Check failure on line 25 in product-mixer/component-library/src/main/scala/com/twitter/product_mixer/component_library/module/http/ProxyCredentialsModule.scala

View check run for this annotation

BoostSecurity.dev AI / boostsecurity - boostsecurityio/semgrep

product-mixer/component-library/src/main/scala/com/twitter/product_mixer/component_library/module/http/ProxyCredentialsModule.scala#L25 

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Copy link
Copy Markdown

@boostsecurity-dev-ai boostsecurity-dev-ai bot Mar 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Original Rule ID: scala_inject_rule-PathTraversalIn
Remediation: Consider using org.apache.commons.io.FilenameUtils.getName() to extract only the filenamecomponent, stripping any directory path information including traversal sequences. Recommendedto validate that file paths resolve to expected directories using File.getCanonicalPath()and comparing against an allowed base directory prefix. Can use java.nio.file.Path.normalize()combined with startsWith() checks to ensure resolved paths remain within alloweddirectories. Implement whitelist validation for allowed filenames or patterns, and rejectpaths containing directory separators (/, ) or traversal sequences (..). For Scalaapplications, consider using safer file access patterns with explicit directory boundariesand validated filename components rather than accepting arbitrary path strings from users.

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

The application opens files for reading using Java file APIs (java.io.File, FileInputStream,
FileReader, RandomAccessFile, java.nio.file.Paths.get(), Files.createTempFile()) and
Scala file APIs (scala.io.Source.fromFile(), Source.fromString()) with filenames
constructed from String parameters or command-line arguments. When unfiltered parameters are
passed to these file APIs, attackers can inject path traversal sequences (../, ../../, absolute
paths) to read files from arbitrary filesystem locations outside intended directories,
potentially exposing sensitive data like configuration files, credentials, or application
source code.
 📘 Learn More


// Disallow path traversal / unexpected file reads by requiring an existing, regular file.
// This also avoids accepting directories or special files.
if (!credentialsFile.exists() || !credentialsFile.isFile) {
throw MissingProxyCredentialsException
}

ProxyCredentials(CredentialsUtil(credentialsFile))
.getOrElse(throw MissingProxyCredentialsException)
}
Expand Down
Loading