Rule Definition
The software does not properly neutralize special elements that are part of paths or file names used in file system operations. This could allow an attacker to access or modify system files or other files that are critical to the application.

Remediation
Assume all input is malicious. Avoid using inputs. If it is not possible, use an "accept known good" input validation strategy, i.e., use stringent allow-lists that limit the character set based on the expected value of the parameter in the request. This will indirectly limit the scope of an attack.

Violation Code Sample

with open(sys.argv[1]) as f:   # violation when opening file with user input
    ...

Fixed Code Sample

filename = sys.argv[1]
if filename in ALLOWED_FILES:    # one possible solution can be using a validated list of files
    with open(filename) as f:
        ...

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') https://cwe.mitre.org/data/definitions/22.html CWE-73: External Control of File Name or Path https://cwe.mitre.org/data/definitions/73.html CWE-434: Unrestricted Upload of File with Dangerous Type https://cwe.mitre.org/data/definitions/434.html Open Web Application Security Project (OWASP) OWASP Top Ten 2017 Category A1:2017-Injection https://www.owasp.org/index.php/Top_10-2017_A1-Injection OWASP Top Ten 2021 Category A03:2021 - Injection https://owasp.org/Top10/A03_2021-Injection/ CISQ rule: ASCSM-CWE-22.