A read from the field Filename
of the type mime/multipart.FileHeader
,
considered as a sanitizer for path traversal.
The only way to create a mime/multipart.FileHeader
is to create a
mime/multipart.Form
, which creates the Filename
field of each
mime/multipart.FileHeader
by calling Part.FileName
, which calls
path/filepath.Base
on its return value. In general path/filepath.Base
is not a sanitizer for path traversal, but in this specific case where the
output is going to be used as a filename rather than a directory name, it
is adequate.
Import path
import semmle.go.security.TaintedPathCustomizations
Direct supertypes
Inherited predicates
asExpr | Gets the expression corresponding to this node, if any. | from Node |
asInstruction | Gets the IR instruction corresponding to this node, if any. | from Node |
asParameter | Gets the parameter corresponding to this node, if any. | from Node |
getAPredecessor | Gets a data-flow node from which data may flow to this node in one (intra-procedural) step. | from Node |
getASuccessor | Gets a data-flow node to which data may flow from this node in one (intra-procedural) step. | from Node |
getBasicBlock | Gets the basic block to which this data-flow node belongs, if any. | from Node |
getBoolValue | Gets the Boolean value this data-flow node contains, if any. | from Node |
getEnclosingCallable | INTERNAL: Use | from Node |
getEndColumn | Gets the end column of the location of this node. | from Node |
getEndLine | Gets the end line of the location of this node. | from Node |
getExactValue | Gets the string representation of the exact value this data-flow node contains, if any. | from Node |
getFile | Gets the file in which this node appears. | from Node |
getFloatValue | Gets the floating-point value this data-flow node contains, if any. | from Node |
getIntValue | Gets the integer value this data-flow node contains, if any. | from Node |
getLocation | Gets the location of this node. | from Node |
getNodeKind | Gets a textual representation of the kind of this data-flow node. | from Node |
getNumericValue | Gets either | from Node |
getRoot | Gets the function to which this node belongs. | from Node |
getStartColumn | Gets the start column of the location of this node. | from Node |
getStartLine | Gets the start line of the location of this node. | from Node |
getStringValue | Gets the string value this data-flow node contains, if any. | from Node |
getType | Gets the type of this node. | from Node |
getTypeBound | Gets an upper bound on the type of this node. | from Node |
hasComplexValue | Holds if the complex value this data-flow node contains has real part | from Node |
hasLocationInfo | Holds if this element is at the specified location. The location spans column | from Node |
isConst | Holds if the value of this data-flow node is known at compile time. | from Node |
isPlatformIndependentConstant | Holds if the result of this instruction is known at compile time, and is guaranteed not to depend on the platform where it is evaluated. | from Node |
toString | Gets a textual representation of this element. | from Node |