The invention discloses a path traversal
vulnerability detection method. The method comprises the following steps of 1, performing program
instrumentation on a
Java EE program through a
byte code enhancement method; 2, by the
instrumentation program, tracking the propagation path of data, obtained from the outside by the
Java EE program, in the program; 3, when the
instrumentation program finds that
external data is directly propagated to the path traversal risk method without passing through a security filtering method, performing
vulnerability detection logic judgment; and when the instrumentation program finds that the
external data is propagated through the security filtering method, determining that the
vulnerability does not exist. According to the method, the data flow direction during running of the application program can be tracked in real time during running of the
Java EE program, the real forming process of the vulnerability and the specific code position of the vulnerability can be detected, and online, real-time, comprehensive and accurate
vulnerability detection is achieved. Meanwhile, whether the vulnerability exists or not can be determined by analyzing the propagation paths of the stains in different scenes, and the possible utilization harm of the vulnerability can be given separately.