skills.rest
wgpsec
wgpsecOFFICIAL
Explore all skills by this author →
Website𝕏@wgpsecGitHub

java-file-audit

Audit Java source code for file upload, read, write, archive extraction, and deletion vulnerabilities.

1.7k|238|Updated Dec 7, 2019
Search Tags:#File Upload#webshell#zip slip#JAVA#Path Traversal#Code Audit#white-box security
One-click install
npx skills add https://github.com/wgpsec/AboutSecurity --skill java-file-audit
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: java-file-audit
Source: https://github.com/wgpsec/AboutSecurity/tree/main/skills/code-audit/java/java-file-audit
Command: npx skills add https://github.com/wgpsec/AboutSecurity --skill java-file-audit

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

White-box auditors reviewing Java codebases need a systematic way to determine whether file-operation vulnerabilities actually exist, rather than relying on pattern matching alone. This Skill verifies path controllability, filename controllability, and content controllability across five file-risk categories, producing structured EVID_* evidence for each finding.

Core Features & Use Cases

  • Sink-Based Decision Tree: Routes audit work by sink function, covering MultipartFile/Part upload, FileInputStream/Files read, FileOutputStream/Files.write, ZipInputStream/ZipFile extraction, and File.delete operations.
  • Dangerous vs Safe Pattern Comparison: The references file contrasts vulnerable code (raw getOriginalFilename, unchecked ZipEntry names) with hardened patterns (UUID renaming, extension whitelists, normalize + startsWith checks, canonical path validation).
  • Evidence-Based Reporting: Defines EVID_UPLOAD, EVID_FILE, EVID_WRITE, EVID_ARCHIVE, EVID_DELETE, and EVID_RACE formats so findings include call sites, sanitization gaps, and resolved target paths.
  • Use Case: During a Spring Boot code audit, you find file.transferTo(new File(dir + file.getOriginalFilename())). The Skill guides you to confirm the upload directory is web-accessible, check for extension whitelisting, and document a Critical arbitrary file upload with EVID_UPLOAD evidence.

Quick Start

Audit this Java controller for file upload and path traversal vulnerabilities and report findings with EVID evidence entries.

Frequently Asked Questions about java-file-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit Java code for file upload vulnerabilities?▼

Check whether three conditions hold simultaneously: an executable extension is allowed, the storage path is web-accessible, and the filename is not renamed or sanitized. MultipartFile.getOriginalFilename() and Part.getSubmittedFileName() return client-controlled names that can contain ../ traversal or malicious extensions.

How to detect path traversal in Java file read operations?▼

Look for user input concatenated into FileInputStream, Files.readAllBytes, or new File() without normalization. The safe pattern resolves the path against a base directory, calls normalize(), and verifies the result with startsWith(baseDir) to block ../ sequences and encoded variants.

What is Zip Slip and how do I find it in Java code?▼

Zip Slip occurs when ZipEntry.getName() containing ../ is used directly to build extraction paths, writing files outside the target directory. Detect it by checking whether extraction code validates each entry with getCanonicalPath() prefixed by the destination directory before writing.

Does checking Content-Type prevent malicious file uploads?▼

No. Content-Type comes from client HTTP headers and is fully forgeable. Reliable validation uses extension whitelists with toLowerCase(), magic bytes verification via ImageIO.read() or Apache Tika, UUID renaming, and storage outside the web root.

What are the limits of source-level file vulnerability auditing?▼

Source audit confirms whether a vulnerability condition exists but does not construct runtime exploitation payloads like upload bypasses or traversal chains; those belong to black-box exploitation skills. It also depends on upstream data-flow evidence to trace taint from sources to sinks.

Related Skills

Explore More Software Engineering Skills→
yunmengyayunmengya
80

php-route-tracer

Trace PHP route execution paths and parameter flow to data sinks.

Community
Advanced
rabbicserabbicse

security-reviewer

Identify security vulnerabilities in code, dependencies, secrets, and infrastructure.

Community
Advanced
olli107xolli107x

audit-security

Audit codebases against OWASP Top 10 vulnerabilities using Bandit, npm audit, and pip-audit.

Community
Advanced
dreadnodedreadnode
11

h2-waf-bypass

Bypass WAF payload inspection using HTTP/2 binary framing attacks.

Official
Advanced