werewolf9988
How to Fix Sobelow Traversal.FileModule: Directory Traversal in `File.write`
I use File.write(path) several times in my code and when I scan it by using Sobelow, it keeps raising Traversal.FileModule: Directory Traversal in File.write - Low Confidence.
Is there any appropriate way to fix it? Thank you in advance.
First Post!
derpycoder
Try using the File.write! version:
unless File.exists?(destination) do
File.mkdir_p(Path.dirname(destination))
end
File.write!(destination, module)
Last Post!
LostKobrakai
How to you compose the paths? Traversal vulnerabilities are about users being able to use paths to gain access to files they shouldn’t have access to (e.g. using /../ or ~/.)
Popular in Questions
Other popular topics
Latest on Elixir Forum
Sponsor Spotlight
Develop your skills with books, videos, and courses.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #deployment
- #library
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #channels
- #elixirconf
- #exunit
- #discussion
- #code-sync
- #javascript
- #podcasts
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #elixir-ls
- #phoenix_html
- #iex
- #blog-post
- #graphql
- #genstage
- #ai
- #websockets
- #supervisor
- #elixirconf-us
- #advent-of-code
- #distillery
- #processes
- #forms
- #api
- #metaprogramming
- #hex
- #security
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking for Elixir devs who love to ship. Start your free account.
Practical resources that improve the lives of professional developers.
Producing high quality Elixir screencasts since 2017.
Enabling companies to succeed by building software people love.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"