Status/Resolution/Reason: Closed/Fixed/
Reporter/Name(from Bugbase): Adam Cameron / Adam Cameron (Adam Cameron)
Created: 03/09/2016
Components: Security Analyzer
Versions: 2016
Failure Type: Unspecified
Found In Build/Fixed In Build: Alpha_v31 /
Priority/Frequency: Normal / Unknown
Locale/System: English / Win All
Vote Count: 0
Consider this code:
<cfdirectory action="list" directory="#expandPath( ’./hardcodedSubDirectory/’ )#" name="files">
<cfscript>
files = directoryList(expandPath( ’./hardcodedSubDirectory/’ ));
</cfscript>
The two statements are:
a) analogous;
b) as far as I can tell pose no risk
However the *first* line gets a warning that it poses a file injection risk.
No it doesn’t. And if it did: so would the second line.
----------------------------- Additional Watson Details -----------------------------
Watson Bug ID: 4126689
External Customer Info:
External Company: Straker Interactive
External Customer Name: Adam Cameron
External Customer Email: CAMERON.ADAM@GMAIL.COM
External Test Config:Attachments:
Comments: