In this section, we'll talk about what DOM-based local file-path manipulation is, look at the potential impact of an attack, highlight some of the sinks that can lead to this kind of vulnerability, and suggest ways that you can reduce your exposure.
Local file-path manipulation vulnerabilities arise when a script passes attacker-controllable data to a file-handling API as the filename parameter. An attacker may be able to use this vulnerability to construct a URL that, if visited by another user, will cause the user's browser to open an arbitrary local file.
The potential impact of this vulnerability depends on how the website uses the opened file:
In both of these cases, the actual exploitability of the potential vulnerability may depend on other suitable functionality being present on the website.
The following are some of the main sinks can lead to DOM-based local file path manipulation vulnerabilities:
In addition to the general measures described on the DOM-based vulnerabilities page, you should avoid allowing data from any untrusted source to dynamically pass a filename to a file-handling API.