SEC008
Path traversal risk
Object Pascal — Delphi & Free Pascal
Error
Security
User-controllable file paths can escape intended directories and access arbitrary files
user-controllable file paths can escape intended directories and access arbitrary files.
Why this severity
user-controllable file paths can escape intended directories and access arbitrary files.
Known false positives
paths fully constructed from trusted constants or validated inputs.
Remediation example
if StartsText(AllowedRoot, ExpandFileName(Path)) then Stream := TFileStream.Create(Path, fmOpenRead);