File-Handling Checks (FILE)

Scope & Objectives

• Detect every class where attacker-controlled input influences a filesystem path or archive entry name: path traversal (CWE-22/CWE-23), absolute-path injection (CWE-36), external control of file name/path passed to any sink (CWE-73), PHP include/require of remote or wrapper-controlled files (CWE-98), and unrestricted upload of dangerous file types (CWE-434).
• Cover these vulnerability families end to end:
  • Path traversal in read, write, download, delete, include, and template-resolution sinks.
  • LFI/RFI: dynamic include/require/import/user-control resolution driven by request data, including PHP stream-wrapper abuse.
  • Arbitrary file upload: extension/MIME/magic/filename validation gaps, landing-directory executability, .htaccess/.config overwrite, polyglot files, traversal-in-filename.
  • Arbitrary file download/read: export/report/invoice/attachment endpoints mapping IDs or names to paths.
  • Arbitrary file deletion (unlink/File.delete/os.Remove) enabling config-wipe-to-reset chains.
  • Archive extraction: Zip Slip (CWE-23 via entry names), tar symlink attacks, partial-overwrite attacks; decompression-amplification itself is scored under CWE-409 and detailed in the DOS module (cross-ref DOS).
  • Symlink and race issues: predictable temp names, mktemp misuse, TOCTOU between containment check and open (cross-ref LOGIC for business-flow impact).
  • Storage-layer notes: S3/GCS keys built from user input, overbroad signed-URL scopes. Deep cloud misconfiguration stays in CONFIG (cross-ref CONFIG).
• Languages in scope: JavaScript/TypeScript (Express/Fastify/Koa, multer), Python (Flask/Django/FastAPI, stdlib zipfile/tarfile), Java/Kotlin (Spring, jakarta.servlet, java.nio/java.util.zip/Apache Commons Compress), C# (ASP.NET Core), PHP (raw/Laravel/Symfony), Ruby (Rails, paperclip/carrierwave/shrine/Active Storage), Go (net/http standard library).
• Deliverables per finding: sink location, tainted source, join/normalization chain, correctness verdict on any existing containment check, exploitability rating from static reasoning, and a concrete fix.
• Assume code-read access only. The curl procedures below are for authorized lab verification against systems you are explicitly permitted to test; never fire payloads at production during a static audit.
• Out of scope here: stored XSS served from uploaded SVG/HTML payloads (cross-ref WEB), zip-bomb resource math (cross-ref DOS), bucket policies/IAM (cross-ref CONFIG), business-logic consequences of TOCTOU (cross-ref LOGIC).