Directory traversal not working correctly?

[mergebase]

Directory traversal not working correctly?

[FSE-SYSADMIN]

The same here also with the newest version:
C:\src>java -jar log4j-detector-2021.12.16.jar "C:" > hits-%computername%.txt
-- github.com/mergebase/log4j-detector v2021.12.16 (by mergebase.com) analyzing paths (could take a while).
-- Note: specify the '--verbose' flag to have every file examined printed to STDERR.
-- No vulnerable Log4J 2.x samples found in supplied paths: [C:]
-- Congratulations, the supplied paths are not vulnerable to CVE-2021-44228 or CVE-2021-45046 ! :-)

C:\src>java -jar log4j-detector-2021.12.16.jar "C:\Program Files" > hits-%computername%.txt
-- github.com/mergebase/log4j-detector v2021.12.16 (by mergebase.com) analyzing paths (could take a while).
-- Note: specify the '--verbose' flag to have every file examined printed to STDERR.
C:\Program Files\OmniBack\bin\telemetry\log4j-core-2.6.2.jar contains Log4J-2.x >= 2.0-beta9 (< 2.10.0) VULNERABLE :-(

[juliusmusseau]

I think this problem is fixed in v2021.12.29. Java treats "C:" and "D:" a bit strangely, so I now convert those to "C:\" and "D:\" etc to make Java behave more like users expect when supplying paths in this way.

[FSE-SYSADMIN]

Thanks for fixing the issue. I had in the meantime found a PowerShell script that I used for scanning. Thanks again anyway.