GHSA-8m5h-hrqm-pxm2 Path traversal in the OWASP Enterprise Security API

• Maven org.owasp.esapi:esapi: < 2.3.0.0 → fixed in 2.3.0.0

Impact The default implementation of `Validator.getValidDirectoryPath(String, String, File, boolean)` may incorrectly treat the tested input string as a child of the specified parent directory. This potentially could allow control-flow bypass checks to be defeated if an attack can specify the entire string representing the 'input' path. Patches This vulnerability is patched in release 2.3.0.0 of ESAPI. See https://github.com/ESAPI/esapi-java-legacy/releases/tag/esapi-2.3.0.0 for details. Workarounds Yes; in theory, one _could_ write the own implementation of the Validator interface. This would most easily be done by sub-classing a version of the affected `DefaultValidator` class and then overriding the affected `getValidDirectoryPath()` to correct the issue. However, this is not recommended. For more information If you have any questions or comments about this advisory: • Email one of the project co-leaders. See email addresses listed on the OWASP ESAPI wiki page, under "Leaders". • Send email to one of the two ESAPI related Google Groups listed under Where to Find More Information on ESAPI on our README.md page.