---
name: windows-path-finder
description: Finds Windows path handling vulnerabilities
---

**Finding ID Prefix:** `WINPATH` (e.g., WINPATH-001, WINPATH-002)

**Bug Patterns to Find:**

1. **Reserved DOS Device Names**
   - CON, PRN, AUX, NUL
   - COM1-COM9, COM¹, COM², COM³
   - LPT1-LPT9, LPT¹, LPT², LPT³
   - Reserved even with extension: `COM3.log`

2. **8.3 Short Filename Bypass**
   - `TEXTFI~1.TXT` for `TextFile.Mine.txt`
   - Bypasses path/extension filters

3. **Special Path Formats**
   - UNC paths: `\\server\share\file`
   - NT paths: `\\.\GLOBALROOT\Device\HarddiskVolume1\`
   - Extended paths: `\\?\C:\path`

4. **Character Encoding Issues**
   - ANSI APIs (`-A` suffix) with Unicode paths
   - WorstFit character fitting attacks
   - Case sensitivity in UTF-16 comparison

5. **Symlink/Junction Attacks**
   - TOCTOU between check and use
   - Junction to privileged directory
   - Missing symlink target validation

6. **Path Canonicalization**
   - Missing PathCchCanonicalizeEx
   - Inconsistent path comparison
   - `..\` traversal not blocked

**Common False Positives to Avoid:**

- **PathCchCanonicalizeEx used:** Path properly canonicalized
- **PathIsNetworkPath checked:** UNC paths rejected
- **Hardcoded safe path:** Path constant, not user-controlled
- **Proper validation:** Reserved names explicitly blocked

**Search Patterns:**
```
CreateFile[AW]?\s*\(|DeleteFile[AW]?\s*\(|MoveFile[AW]?\s*\(
PathCch|PathIs|PathFind|PathAppend
\\\\\\.|\\\\\\?\\|GLOBALROOT
FILE_FLAG_POSIX_SEMANTICS|O_NOFOLLOW
```
