René's URL Explorer Experiment


Title: Java: Promote Unsafe URL Forward query from experimental by jcogs33 · Pull Request #14854 · github/codeql · GitHub

Open Graph Title: Java: Promote Unsafe URL Forward query from experimental by jcogs33 · Pull Request #14854 · github/codeql

X Title: Java: Promote Unsafe URL Forward query from experimental by jcogs33 · Pull Request #14854 · github/codeql

Description: This PR promotes java/unsafe-url-forward-dispatch-load from experimental (#6240 and #7286). Note: this promotion does not include the resource-related additions in #8706 and 9199. Since we already model some of these resource methods (example) as path-injection sinks, it probably makes more sense to add them to the path-injection query instead (see #15921). Let me know if you think any of these models should be added back to this query instead.

Open Graph Description: This PR promotes java/unsafe-url-forward-dispatch-load from experimental (#6240 and #7286). Note: this promotion does not include the resource-related additions in #8706 and 9199. Since we already ...

X Description: This PR promotes java/unsafe-url-forward-dispatch-load from experimental (#6240 and #7286). Note: this promotion does not include the resource-related additions in #8706 and 9199. Since we already ...

Opengraph URL: https://github.com/github/codeql/pull/14854

X: @github

direct link

Domain: github.com

route-pattern/:user_id/:repository/pull/:id/files(.:format)
route-controllerpull_requests
route-actionfiles
fetch-noncev2:c9b3e1a0-14f6-6d1b-8378-cc14d352ce15
current-catalog-service-hashae870bc5e265a340912cde392f23dad3671a0a881730ffdadd82f2f57d81641b
request-idDC0E:1EDE:1B9AF1:277EFA:6A4CBF0C
html-safe-nonce502bbf14ac90e964dd15fc9b80da663c2750045b1ccee61a8f14986a8cb3d5db
visitor-payloadeyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiJEQzBFOjFFREU6MUI5QUYxOjI3N0VGQTo2QTRDQkYwQyIsInZpc2l0b3JfaWQiOiI1Nzk3NDIzOTkxMjQxODgzNDA0IiwicmVnaW9uX2VkZ2UiOiJpYWQiLCJyZWdpb25fcmVuZGVyIjoiaWFkIn0=
visitor-hmace4aa70c28ffaec619a43ecd993b4923faec92993f9bc9f5752c1d88ee05f3af7
hovercard-subject-tagpull_request:1609992356
github-keyboard-shortcutsrepository,pull-request-list,pull-request-conversation,pull-request-files-changed,copilot
google-site-verificationApib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I
octolytics-urlhttps://collector.github.com/github/collect
analytics-location///pull_requests/show/files
fb:app_id1401488693436528
apple-itunes-appapp-id=1477376905, app-argument=https://github.com/github/codeql/pull/14854/files
twitter:imagehttps://avatars.githubusercontent.com/u/57204504?s=400&v=4
twitter:cardsummary_large_image
og:imagehttps://avatars.githubusercontent.com/u/57204504?s=400&v=4
og:image:altThis PR promotes java/unsafe-url-forward-dispatch-load from experimental (#6240 and #7286). Note: this promotion does not include the resource-related additions in #8706 and 9199. Since we already ...
og:site_nameGitHub
og:typeobject
hostnamegithub.com
expected-hostnamegithub.com
None3d11bb817438277de2a940854450e83a7d32b6aeb5014e9e6b00a6423900251c
turbo-cache-controlno-preview
diff-viewunified
go-importgithub.com/github/codeql git https://github.com/github/codeql.git
octolytics-dimension-user_id9919
octolytics-dimension-user_logingithub
octolytics-dimension-repository_id143040428
octolytics-dimension-repository_nwogithub/codeql
octolytics-dimension-repository_publictrue
octolytics-dimension-repository_is_forkfalse
octolytics-dimension-repository_network_root_id143040428
octolytics-dimension-repository_network_root_nwogithub/codeql
turbo-body-classeslogged-out env-production page-responsive full-width
disable-turbotrue
browser-stats-urlhttps://api.github.com/_private/browser/stats
browser-errors-urlhttps://api.github.com/_private/browser/errors
releasec03e7e569190bc89b638cdd4acb4b6c6b38a170a
ui-targetfull
theme-color#1e2327
color-schemelight dark

Links:

Skip to contenthttps://github.com/github/codeql/pull/14854/files#start-of-content
https://github.com/
Sign in https://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Fgithub%2Fcodeql%2Fpull%2F14854%2Ffiles
GitHub CopilotWrite better code with AIhttps://github.com/features/copilot
GitHub Copilot appDirect agents from issue to mergehttps://github.com/features/ai/github-app
MCP RegistryNewIntegrate external toolshttps://github.com/mcp
ActionsAutomate any workflowhttps://github.com/features/actions
CodespacesInstant dev environmentshttps://github.com/features/codespaces
IssuesPlan and track workhttps://github.com/features/issues
Code ReviewManage code changeshttps://github.com/features/code-review
GitHub Advanced SecurityFind and fix vulnerabilitieshttps://github.com/security/advanced-security
Code securitySecure your code as you buildhttps://github.com/security/advanced-security/code-security
Secret protectionStop leaks before they starthttps://github.com/security/advanced-security/secret-protection
Why GitHubhttps://github.com/why-github
Documentationhttps://docs.github.com
Bloghttps://github.blog
Changeloghttps://github.blog/changelog
Marketplacehttps://github.com/marketplace
View all featureshttps://github.com/features
Enterpriseshttps://github.com/enterprise
Small and medium teamshttps://github.com/team
Startupshttps://github.com/enterprise/startups
Nonprofitshttps://github.com/solutions/industry/nonprofits
App Modernizationhttps://github.com/solutions/use-case/app-modernization
DevSecOpshttps://github.com/solutions/use-case/devsecops
DevOpshttps://github.com/solutions/use-case/devops
CI/CDhttps://github.com/solutions/use-case/ci-cd
View all use caseshttps://github.com/solutions/use-case
Healthcarehttps://github.com/solutions/industry/healthcare
Financial serviceshttps://github.com/solutions/industry/financial-services
Manufacturinghttps://github.com/solutions/industry/manufacturing
Governmenthttps://github.com/solutions/industry/government
View all industrieshttps://github.com/solutions/industry
View all solutionshttps://github.com/solutions
AIhttps://github.com/resources/articles?topic=ai
Software Developmenthttps://github.com/resources/articles?topic=software-development
DevOpshttps://github.com/resources/articles?topic=devops
Securityhttps://github.com/resources/articles?topic=security
View all topicshttps://github.com/resources/articles
Customer storieshttps://github.com/customer-stories
Events & webinarshttps://github.com/resources/events
Ebooks & reportshttps://github.com/resources/whitepapers
Business insightshttps://github.com/solutions/executive-insights
GitHub Skillshttps://skills.github.com
Documentationhttps://docs.github.com
Customer supporthttps://support.github.com
Community forumhttps://github.com/orgs/community/discussions
Trust centerhttps://github.com/trust-center
Partnershttps://github.com/partners
View all resourceshttps://github.com/resources
GitHub SponsorsFund open source developershttps://github.com/sponsors
Security Labhttps://securitylab.github.com
Maintainer Communityhttps://maintainers.github.com
Acceleratorhttps://github.com/accelerator
GitHub Starshttps://stars.github.com
Archive Programhttps://archiveprogram.github.com
Topicshttps://github.com/topics
Trendinghttps://github.com/trending
Collectionshttps://github.com/collections
Enterprise platformAI-powered developer platformhttps://github.com/enterprise
GitHub Advanced SecurityEnterprise-grade security featureshttps://github.com/security/advanced-security
Copilot for BusinessEnterprise-grade AI featureshttps://github.com/features/copilot/copilot-business
Premium SupportEnterprise-grade 24/7 supporthttps://github.com/premium-support
Pricinghttps://github.com/pricing
Search syntax tipshttps://docs.github.com/search-github/github-code-search/understanding-github-code-search-syntax
documentationhttps://docs.github.com/search-github/github-code-search/understanding-github-code-search-syntax
Sign in https://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Fgithub%2Fcodeql%2Fpull%2F14854%2Ffiles
Sign up https://github.com/signup?ref_cta=Sign+up&ref_loc=header+logged+out&ref_page=%2F%3Cuser-name%3E%2F%3Crepo-name%3E%2Fpull_requests%2Fshow%2Ffiles&source=header-repo&source_repo=github%2Fcodeql
Reloadhttps://github.com/github/codeql/pull/14854/files
Reloadhttps://github.com/github/codeql/pull/14854/files
Reloadhttps://github.com/github/codeql/pull/14854/files
Please reload this pagehttps://github.com/github/codeql/pull/14854/files
github https://github.com/github
codeqlhttps://github.com/github/codeql
Notifications https://github.com/login?return_to=%2Fgithub%2Fcodeql
Fork 2k https://github.com/login?return_to=%2Fgithub%2Fcodeql
Star 9.8k https://github.com/login?return_to=%2Fgithub%2Fcodeql
Code https://github.com/github/codeql
Issues 987 https://github.com/github/codeql/issues
Pull requests 424 https://github.com/github/codeql/pulls
Discussions https://github.com/github/codeql/discussions
Actions https://github.com/github/codeql/actions
Projects https://github.com/github/codeql/projects
Models https://github.com/github/codeql/models
Security and quality 0 https://github.com/github/codeql/security
Insights https://github.com/github/codeql/pulse
Code https://github.com/github/codeql
Issues https://github.com/github/codeql/issues
Pull requests https://github.com/github/codeql/pulls
Discussions https://github.com/github/codeql/discussions
Actions https://github.com/github/codeql/actions
Projects https://github.com/github/codeql/projects
Models https://github.com/github/codeql/models
Security and quality https://github.com/github/codeql/security
Insights https://github.com/github/codeql/pulse
Sign up for GitHub https://github.com/signup?return_to=%2Fgithub%2Fcodeql%2Fissues%2Fnew%2Fchoose
terms of servicehttps://docs.github.com/terms
privacy statementhttps://docs.github.com/privacy
Sign inhttps://github.com/login?return_to=%2Fgithub%2Fcodeql%2Fissues%2Fnew%2Fchoose
jcogs33https://github.com/jcogs33
github:mainhttps://github.com/github/codeql/tree/main
jcogs33:jcogs33/unsafe-url-forward-promotionhttps://github.com/jcogs33/codeql/tree/jcogs33/unsafe-url-forward-promotion
Conversation 35 https://github.com/github/codeql/pull/14854
Findings https://github.com/github/codeql/pull/14854/findings
Commits 40 https://github.com/github/codeql/pull/14854/commits
Checks 0 https://github.com/github/codeql/pull/14854/checks
Files changed https://github.com/github/codeql/pull/14854/files
Please reload this pagehttps://github.com/github/codeql/pull/14854/files
Java: Promote Unsafe URL Forward query from experimental https://github.com/github/codeql/pull/14854/files#top
Show all changes 40 commits https://github.com/github/codeql/pull/14854/files
0d38a96 Java: copy files from experimental Nov 20, 2023 https://github.com/github/codeql/pull/14854/commits/0d38a9625e039120e715dfe79b529dc5bfead3d8
2793f28 Java: move config to Query.qll file Nov 20, 2023 https://github.com/github/codeql/pull/14854/commits/2793f28428567060b66819525a5a045f52f2228d
35a083a Java: update test cases to use inline expectations Nov 20, 2023 https://github.com/github/codeql/pull/14854/commits/35a083ae9e5c70a29ac426cf54112ef98286507b
915e106 Java: remove path-injection related models and tests for now Nov 20, 2023 https://github.com/github/codeql/pull/14854/commits/915e106ab382aaa060e11b02e34d61c7434452c6
2a68299 Java: move MaD models to correct files, delete ones that already exist Nov 30, 2023 https://github.com/github/codeql/pull/14854/commits/2a682995aeadbb919d4c400b916c7737fae0b150
4ff884e Java: remove more path-injection related classes (will maybe add some… Nov 30, 2023 https://github.com/github/codeql/pull/14854/commits/4ff884e26cad54486745861fe1145c6539418f8c
42e3825 Java: convert RequestDispatcherSink to MaD Mar 5, 2024 https://github.com/github/codeql/pull/14854/commits/42e3825ea3b50ee362ae723c657744de85860e5e
8d66097 Java: switch StaplerResponse.forward from request-forgery sink to url… Nov 30, 2023 https://github.com/github/codeql/pull/14854/commits/8d66097483a8892d4a15c2232e63d883035a45f9
1da1e89 Java: convert SpringModelAndViewSink to MaD Mar 5, 2024 https://github.com/github/codeql/pull/14854/commits/1da1e896cbc8eb1b918c8c4950010b53146391a6
5a9d755 Java: add some comments and minor code reorg Nov 30, 2023 https://github.com/github/codeql/pull/14854/commits/5a9d7552b3d92aba8cdee9a75ea95c02819bb4cf
6e7c054 Java: update query metadata and alert message Dec 1, 2023 https://github.com/github/codeql/pull/14854/commits/6e7c05467bddf44f0411920392b6886f680c5ecf
09bc21d Java: rename 'UnsafeUrlForward' to 'UrlForward' Dec 1, 2023 https://github.com/github/codeql/pull/14854/commits/09bc21dbd36e4f0e4ab954d5f691bc440b2cb0c5
c331393 Java: update qhelp Dec 1, 2023 https://github.com/github/codeql/pull/14854/commits/c331393cfd3982f06098e7f1a0613124c0cb44f4
5fa63ab Java: update/add some TODO comments Dec 4, 2023 https://github.com/github/codeql/pull/14854/commits/5fa63ab5c22adc24b62cdfdc4efe12e578ede3bf
e75c96c Java: combine test cases; add test for StaplerResponse.forward Dec 11, 2023 https://github.com/github/codeql/pull/14854/commits/e75c96c0f9be67d4423446177dedc808a1ec9239
c8ec301 Java: add change note Dec 11, 2023 https://github.com/github/codeql/pull/14854/commits/c8ec301793067bb1d9d6c9f5e9ccacc59d086f01
911a61d Java: initial update of barrier and test cases to remove FN Mar 5, 2024 https://github.com/github/codeql/pull/14854/commits/911a61df2234dc5f9519e3238159f2e7f53f1d3f
f573032 Java: remove todo comments from ext files Mar 5, 2024 https://github.com/github/codeql/pull/14854/commits/f573032b2e74ccf8165650b83602b08a8f2af126
2708e53 Java: remove redundant imports Mar 5, 2024 https://github.com/github/codeql/pull/14854/commits/2708e53c7f3b54f1755596513aad1b444457ee9b
43b4962 Java: use new 'SimpleTypeSanitizer', and update some non-extending su… Mar 5, 2024 https://github.com/github/codeql/pull/14854/commits/43b49628fc54cd2de38768e14ff9f22720852919
d9772c1 Java: update change note Mar 5, 2024 https://github.com/github/codeql/pull/14854/commits/d9772c1880bb269c0c8e61db3beae8587bae8822
d220b3a Java: some updates to test cases Mar 10, 2024 https://github.com/github/codeql/pull/14854/commits/d220b3a298044753382b0677d054e51da23a1246
052452b Java: create UrlDecodeMethod Mar 10, 2024 https://github.com/github/codeql/pull/14854/commits/052452b18666e793783032da33fd1863e5d7121f
042dcf9 Java: some updates to UrlPathBarrier code Mar 10, 2024 https://github.com/github/codeql/pull/14854/commits/042dcf9cd961e2b24b30220b8f7618221022f339
a807596 Java: add QLDocs to UrlPathBarrier code Mar 10, 2024 https://github.com/github/codeql/pull/14854/commits/a8075969d886bc86ef60b12f10bdf551f4145eba
a002674 Java: clean up comments on test cases Mar 11, 2024 https://github.com/github/codeql/pull/14854/commits/a002674587b255694088bed6768b8c16cf6ffac9
7310c15 Java: rename SpringUrlForwardSink Mar 11, 2024 https://github.com/github/codeql/pull/14854/commits/7310c155e24a238316224adf9cff9204f174d843
c5a59d6 Java: add QLDoc Mar 11, 2024 https://github.com/github/codeql/pull/14854/commits/c5a59d6c514cbe2c8985ada441bdd5203b9c615e
e99cea3 Java: update UrlPathBarrier to include FollowsBarrierPrefix Mar 12, 2024 https://github.com/github/codeql/pull/14854/commits/e99cea340bcf8902bf133c8913cf867d943475c9
04d27f2 Java: adjust prefix barriers Mar 13, 2024 https://github.com/github/codeql/pull/14854/commits/04d27f2d65e9fa1833731889404e57c33f9a22f0
5ac453e Java: add spurious test case for StringBuilder.append Mar 13, 2024 https://github.com/github/codeql/pull/14854/commits/5ac453eb38813b14f0e62c2215486581c3943b87
1b01f26 Java: adjust BarrierPrefix to handle prepended chars Mar 13, 2024 https://github.com/github/codeql/pull/14854/commits/1b01f26d09dc118c3796846ceaa975525c3ccf6f
55f7369 Java: performance fix Mar 15, 2024 https://github.com/github/codeql/pull/14854/commits/55f7369df0d44893dd4cd4d843b7e740cc764854
658fffe Java: remove experimental files Mar 18, 2024 https://github.com/github/codeql/pull/14854/commits/658fffeac1acaf6e3b823635efd27df7f611584f
a8eb1d1 Java: remove experimental tests Mar 18, 2024 https://github.com/github/codeql/pull/14854/commits/a8eb1d10f646c0928dfb97b29d7fe418aadb8bab
35fbc95 Java: remove redundant line Mar 27, 2024 https://github.com/github/codeql/pull/14854/commits/35fbc95cc743f63b16a68f8f5f6ce82a9d0bdbeb
121b24e Java: remove parentheses Mar 27, 2024 https://github.com/github/codeql/pull/14854/commits/121b24ea7c0e21f2032afc64b54f4de85bda9275
2391fe7 Java: use InlineFlowTest instead of InlineExpectationsTest Mar 27, 2024 https://github.com/github/codeql/pull/14854/commits/2391fe7d89ff46cad715c09963c73ae6a8fd6f90
40c932a Java: move UrlForward.qll code to UrlForwardQuery.qll Mar 27, 2024 https://github.com/github/codeql/pull/14854/commits/40c932a5f911c7ad5c1ca0cd5d517ee6081f4107
2f8c4df docs wording updates jcogs33 Mar 28, 2024 https://github.com/github/codeql/pull/14854/commits/2f8c4df309a177c46aa5d2ad60919ebad815db62
Clear filters https://github.com/github/codeql/pull/14854/files
Please reload this pagehttps://github.com/github/codeql/pull/14854/files
Please reload this pagehttps://github.com/github/codeql/pull/14854/files
io.undertow.server.handlers.resource.model.yml https://github.com/github/codeql/pull/14854/files#diff-33cf17e36afb575eb10419fda992787b61a54ec6f115dceb1062c23b58941bf8
java.nio.file.model.yml https://github.com/github/codeql/pull/14854/files#diff-6f4bc2cd1b89f1a089db22074722fd360f21f169f158e05fad913cf0e36e59ea
java.util.concurrent.model.yml https://github.com/github/codeql/pull/14854/files#diff-54480091f2288f67db1a33444e9d7107a0f052eef06a513bb76a010ff443c4e6
javax.servlet.http.model.yml https://github.com/github/codeql/pull/14854/files#diff-36b584180bd4dd55b84bf210cdb6fcb93dcb3825d7cab9d470e195f61ec77845
org.springframework.core.io.model.yml https://github.com/github/codeql/pull/14854/files#diff-0ebe996bd717c518580d5e1c433b6ceec7beb8c95b32f1bfbec0e3b118c95adf
jakarta.servlet.http.model.yml https://github.com/github/codeql/pull/14854/files#diff-318256da18c6747251d00d8e92b64f723542f5ffe408c4291f9be05b85dc2169
jakarta.servlet.model.yml https://github.com/github/codeql/pull/14854/files#diff-3a858c40bf779e2ba8fc751f0a13b79bdc085ece16a6720908b2769db9f84c8f
javax.portlet.model.yml https://github.com/github/codeql/pull/14854/files#diff-fdbb0464a7ae8664f151014d479807ee66288e6e1a987aa8e0a2fa721b673ced
javax.servlet.http.model.yml https://github.com/github/codeql/pull/14854/files#diff-79d08cedb1555122e38aeb5e5eaf339d557e1d64f605247a03883de31c96158e
javax.servlet.model.yml https://github.com/github/codeql/pull/14854/files#diff-c99a4adda4ae854cc26f80e70e269ae0f76b7a45138bee7653c329c608db514b
org.kohsuke.stapler.model.yml https://github.com/github/codeql/pull/14854/files#diff-3c1b072f28eaabd5a24121f611aeef011d8d62fb805912aaa0f674fe82040ce0
org.springframework.web.portlet.model.yml https://github.com/github/codeql/pull/14854/files#diff-66ab27c7323334c910447f801d3271bae1a9bfaa088ac64f7d54f7fd129a209d
org.springframework.web.servlet.model.yml https://github.com/github/codeql/pull/14854/files#diff-3a1a4e1c0504340ede933d6746a8af5420ea07008ba8968f64e55d9bcc0d42af
JDK.qll https://github.com/github/codeql/pull/14854/files#diff-5a12ffa8bdfc5c948bd251fdeebcf8d4bc8c108d1efecd68d3a181514986e571
Networking.qll https://github.com/github/codeql/pull/14854/files#diff-37c821443f7c3273db130299928ca308d6376bcb8903d369665d4ff48faf5db6
PathSanitizer.qll https://github.com/github/codeql/pull/14854/files#diff-38978229f15815dd860ec9f3696f469770f85b8082736b808072ef64be18a834
UrlForwardQuery.qll https://github.com/github/codeql/pull/14854/files#diff-8df78ba740135187938580722e32cd4d7312be48a79d76efdb69775d1096175c
UrlForward.java https://github.com/github/codeql/pull/14854/files#diff-50bdec90d08601bef7feeb33e1f2643a8a4cb8a0a4dc85d03ec0757b9838ec99
UrlForward.qhelp https://github.com/github/codeql/pull/14854/files#diff-e6b081066bb460a734a1a39938f6a8890ad40705cff8f70deefac95fdb5957a1
UrlForward.ql https://github.com/github/codeql/pull/14854/files#diff-838f9417cf68951cb4de778cd72181d41c8f69e9cb5370a737664f99977c032e
2024-03-06-url-forward-query.md https://github.com/github/codeql/pull/14854/files#diff-4c1318ee95ff11e2858c233932eeeeb3efcf484f89afca3c3c89c403981a6fb9
UnsafeLoadSpringResource.java https://github.com/github/codeql/pull/14854/files#diff-0e56fadcb29ab30b8b9a36beaad4289e301d09577007be05b125446192c5ba01
UnsafeResourceGet.java https://github.com/github/codeql/pull/14854/files#diff-f94b0a2672fcbdadc8d612e674ac08eac46361fe25079506cad2cca37a6d5397
UnsafeServletRequestDispatch.java https://github.com/github/codeql/pull/14854/files#diff-805730cadcfe1d72986a16492864bb2a853e59d650ac947b163182cc8d6ecec3
UnsafeUrlForward.java https://github.com/github/codeql/pull/14854/files#diff-56b37fac889d047a899e6a17e00ed3f979af118ee73bfebc6d5dea55311dafbf
UnsafeUrlForward.qhelp https://github.com/github/codeql/pull/14854/files#diff-3e5cfcc60b5abc0126d377789c00f2606f31d2cb303c412acca9c927e0a0d722
UnsafeUrlForward.ql https://github.com/github/codeql/pull/14854/files#diff-3caec98bb63246165cd000f9dbbac654f2cd460af72d62cc2b6c0001f62eaf5e
UnsafeUrlForward.qll https://github.com/github/codeql/pull/14854/files#diff-171b613f67732add15b5c1b18e1c983ed4522338e7debe776016bcd4f13ffcba
UnsafeLoadSpringResource.java https://github.com/github/codeql/pull/14854/files#diff-cf83104064664b3a1ee5f1b27d2d16e1c8f4316377aaaa68c5dba964e0823433
UnsafeRequestPath.java https://github.com/github/codeql/pull/14854/files#diff-5bd5df81382259b5c474e0903462951c316c4b034fa3c9415fb1c0e50df98eda
UnsafeResourceGet.java https://github.com/github/codeql/pull/14854/files#diff-53935816105637af9dd5b1066a1bb40281477452fc11651e1cf77fe92a2fed28
UnsafeResourceGet2.java https://github.com/github/codeql/pull/14854/files#diff-257d785825362eb6a2cfd0e6af0275f21f5ad35a54d103b53e0f33a02572f387
UnsafeServletRequestDispatch.java https://github.com/github/codeql/pull/14854/files#diff-6bc44c5765a6e460db430d2c13a69b22afe818b46bc96d630508b5e1d1cd6eb1
UnsafeUrlForward.expected https://github.com/github/codeql/pull/14854/files#diff-cee29b69dfd9b0b1243fd0589f66ac94dfd0c3b43cd5de6892331df28db85f95
UnsafeUrlForward.java https://github.com/github/codeql/pull/14854/files#diff-5d1cb9b9bddca39c10c82f29297e86482034283701a68060207e54253793e3f3
UnsafeUrlForward.qlref https://github.com/github/codeql/pull/14854/files#diff-a408207c960f8b61f40e570a22e1d9daf03394f0a5a06cfce5499b0d6779d02d
options https://github.com/github/codeql/pull/14854/files#diff-a23d6723ceb9ac152050ee8f7d948a8b29e6f3b36a0143e4f85a7272e62e5d0c
UrlForwardTest.expected https://github.com/github/codeql/pull/14854/files#diff-094588b50599f51f87a29ff21159ce2252b473754e3774a731f430dfdd889849
UrlForwardTest.java https://github.com/github/codeql/pull/14854/files#diff-9961edeedb3f11f4f5c518e257d8025e39e03974cefc14a05c48cd74cc378b1d
UrlForwardTest.ql https://github.com/github/codeql/pull/14854/files#diff-c21f70011afafbe073c8420c55c3adfa55116e530ddbc7b21a99c355b7b18491
options https://github.com/github/codeql/pull/14854/files#diff-4a37cf7c6d1b7b28aaee1f1cf811c5a6af73d0c586984374dc373e65e274d625
ModelValidation.qll https://github.com/github/codeql/pull/14854/files#diff-91aa4933a4678a234e67334da0e0feb29f52cc2b3f396a2b13b5d63d64442db4
https://github.com/github/codeql/blob/main/CODEOWNERS#L16
java/ql/lib/ext/experimental/io.undertow.server.handlers.resource.model.ymlhttps://github.com/github/codeql/pull/14854/files#diff-33cf17e36afb575eb10419fda992787b61a54ec6f115dceb1062c23b58941bf8
View file https://github.com/github/codeql/blob/67b3670d0669ec31c8dee085f9ee49904cdd9dd7/java/ql/lib/ext/experimental/io.undertow.server.handlers.resource.model.yml
Open in desktop https://desktop.github.com
Please reload this pagehttps://github.com/github/codeql/pull/14854/files
https://github.com/github/codeql/blob/main/CODEOWNERS#L16
java/ql/lib/ext/experimental/java.nio.file.model.ymlhttps://github.com/github/codeql/pull/14854/files#diff-6f4bc2cd1b89f1a089db22074722fd360f21f169f158e05fad913cf0e36e59ea
View file https://github.com/github/codeql/blob/67b3670d0669ec31c8dee085f9ee49904cdd9dd7/java/ql/lib/ext/experimental/java.nio.file.model.yml
Open in desktop https://desktop.github.com
Please reload this pagehttps://github.com/github/codeql/pull/14854/files
https://github.com/github/codeql/blob/main/CODEOWNERS#L16
java/ql/lib/ext/experimental/java.util.concurrent.model.ymlhttps://github.com/github/codeql/pull/14854/files#diff-54480091f2288f67db1a33444e9d7107a0f052eef06a513bb76a010ff443c4e6
View file https://github.com/jcogs33/codeql/blob/2f8c4df309a177c46aa5d2ad60919ebad815db62/java/ql/lib/ext/experimental/java.util.concurrent.model.yml
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/14854/{{ revealButtonHref }}
https://github.com/github/codeql/pull/14854/files#diff-54480091f2288f67db1a33444e9d7107a0f052eef06a513bb76a010ff443c4e6
https://github.com/github/codeql/blob/main/CODEOWNERS#L16
java/ql/lib/ext/experimental/javax.servlet.http.model.ymlhttps://github.com/github/codeql/pull/14854/files#diff-36b584180bd4dd55b84bf210cdb6fcb93dcb3825d7cab9d470e195f61ec77845
View file https://github.com/jcogs33/codeql/blob/2f8c4df309a177c46aa5d2ad60919ebad815db62/java/ql/lib/ext/experimental/javax.servlet.http.model.yml
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/14854/{{ revealButtonHref }}
https://github.com/github/codeql/pull/14854/files#diff-36b584180bd4dd55b84bf210cdb6fcb93dcb3825d7cab9d470e195f61ec77845
https://github.com/github/codeql/blob/main/CODEOWNERS#L16
java/ql/lib/ext/experimental/org.springframework.core.io.model.ymlhttps://github.com/github/codeql/pull/14854/files#diff-0ebe996bd717c518580d5e1c433b6ceec7beb8c95b32f1bfbec0e3b118c95adf
View file https://github.com/github/codeql/blob/67b3670d0669ec31c8dee085f9ee49904cdd9dd7/java/ql/lib/ext/experimental/org.springframework.core.io.model.yml
Open in desktop https://desktop.github.com
Please reload this pagehttps://github.com/github/codeql/pull/14854/files
https://github.com/github/codeql/blob/main/CODEOWNERS#L16
...perimental/jakarta.servlet.http.model.yml → ...ql/lib/ext/jakarta.servlet.http.model.ymlhttps://github.com/github/codeql/pull/14854/files#diff-318256da18c6747251d00d8e92b64f723542f5ffe408c4291f9be05b85dc2169
View file https://github.com/jcogs33/codeql/blob/2f8c4df309a177c46aa5d2ad60919ebad815db62/java/ql/lib/ext/jakarta.servlet.http.model.yml
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/14854/{{ revealButtonHref }}
https://github.com/github/codeql/blob/main/CODEOWNERS#L16
java/ql/lib/ext/jakarta.servlet.model.ymlhttps://github.com/github/codeql/pull/14854/files#diff-3a858c40bf779e2ba8fc751f0a13b79bdc085ece16a6720908b2769db9f84c8f
View file https://github.com/jcogs33/codeql/blob/2f8c4df309a177c46aa5d2ad60919ebad815db62/java/ql/lib/ext/jakarta.servlet.model.yml
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/14854/{{ revealButtonHref }}
https://github.com/github/codeql/blob/main/CODEOWNERS#L16
java/ql/lib/ext/javax.portlet.model.ymlhttps://github.com/github/codeql/pull/14854/files#diff-fdbb0464a7ae8664f151014d479807ee66288e6e1a987aa8e0a2fa721b673ced
View file https://github.com/jcogs33/codeql/blob/2f8c4df309a177c46aa5d2ad60919ebad815db62/java/ql/lib/ext/javax.portlet.model.yml
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/14854/{{ revealButtonHref }}
https://github.com/github/codeql/blob/main/CODEOWNERS#L16
java/ql/lib/ext/javax.servlet.http.model.ymlhttps://github.com/github/codeql/pull/14854/files#diff-79d08cedb1555122e38aeb5e5eaf339d557e1d64f605247a03883de31c96158e
View file https://github.com/jcogs33/codeql/blob/2f8c4df309a177c46aa5d2ad60919ebad815db62/java/ql/lib/ext/javax.servlet.http.model.yml
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/14854/{{ revealButtonHref }}
https://github.com/github/codeql/pull/14854/files#diff-79d08cedb1555122e38aeb5e5eaf339d557e1d64f605247a03883de31c96158e
https://github.com/github/codeql/pull/14854/files#diff-79d08cedb1555122e38aeb5e5eaf339d557e1d64f605247a03883de31c96158e
https://github.com/github/codeql/blob/main/CODEOWNERS#L16
java/ql/lib/ext/javax.servlet.model.ymlhttps://github.com/github/codeql/pull/14854/files#diff-c99a4adda4ae854cc26f80e70e269ae0f76b7a45138bee7653c329c608db514b
View file https://github.com/jcogs33/codeql/blob/2f8c4df309a177c46aa5d2ad60919ebad815db62/java/ql/lib/ext/javax.servlet.model.yml
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/14854/{{ revealButtonHref }}
https://github.com/github/codeql/pull/14854/files#diff-c99a4adda4ae854cc26f80e70e269ae0f76b7a45138bee7653c329c608db514b
Please reload this pagehttps://github.com/github/codeql/pull/14854/files
https://github.com/github/codeql/pull/14854/files#diff-c99a4adda4ae854cc26f80e70e269ae0f76b7a45138bee7653c329c608db514b
https://github.com/github/codeql/blob/main/CODEOWNERS#L16
java/ql/lib/ext/org.kohsuke.stapler.model.ymlhttps://github.com/github/codeql/pull/14854/files#diff-3c1b072f28eaabd5a24121f611aeef011d8d62fb805912aaa0f674fe82040ce0
View file https://github.com/jcogs33/codeql/blob/2f8c4df309a177c46aa5d2ad60919ebad815db62/java/ql/lib/ext/org.kohsuke.stapler.model.yml
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/14854/{{ revealButtonHref }}
https://github.com/github/codeql/pull/14854/files#diff-3c1b072f28eaabd5a24121f611aeef011d8d62fb805912aaa0f674fe82040ce0
https://github.com/github/codeql/pull/14854/files#diff-3c1b072f28eaabd5a24121f611aeef011d8d62fb805912aaa0f674fe82040ce0
https://github.com/github/codeql/blob/main/CODEOWNERS#L16
java/ql/lib/ext/org.springframework.web.portlet.model.ymlhttps://github.com/github/codeql/pull/14854/files#diff-66ab27c7323334c910447f801d3271bae1a9bfaa088ac64f7d54f7fd129a209d
View file https://github.com/jcogs33/codeql/blob/2f8c4df309a177c46aa5d2ad60919ebad815db62/java/ql/lib/ext/org.springframework.web.portlet.model.yml
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/14854/{{ revealButtonHref }}
https://github.com/github/codeql/blob/main/CODEOWNERS#L16
java/ql/lib/ext/org.springframework.web.servlet.model.ymlhttps://github.com/github/codeql/pull/14854/files#diff-3a1a4e1c0504340ede933d6746a8af5420ea07008ba8968f64e55d9bcc0d42af
View file https://github.com/jcogs33/codeql/blob/2f8c4df309a177c46aa5d2ad60919ebad815db62/java/ql/lib/ext/org.springframework.web.servlet.model.yml
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/14854/{{ revealButtonHref }}
https://github.com/github/codeql/blob/main/CODEOWNERS#L16
java/ql/lib/semmle/code/java/JDK.qllhttps://github.com/github/codeql/pull/14854/files#diff-5a12ffa8bdfc5c948bd251fdeebcf8d4bc8c108d1efecd68d3a181514986e571
View file https://github.com/jcogs33/codeql/blob/2f8c4df309a177c46aa5d2ad60919ebad815db62/java/ql/lib/semmle/code/java/JDK.qll
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/14854/{{ revealButtonHref }}
https://github.com/github/codeql/pull/14854/files#diff-5a12ffa8bdfc5c948bd251fdeebcf8d4bc8c108d1efecd68d3a181514986e571
https://github.com/github/codeql/pull/14854/files#diff-5a12ffa8bdfc5c948bd251fdeebcf8d4bc8c108d1efecd68d3a181514986e571
https://github.com/github/codeql/blob/main/CODEOWNERS#L16
java/ql/lib/semmle/code/java/frameworks/Networking.qllhttps://github.com/github/codeql/pull/14854/files#diff-37c821443f7c3273db130299928ca308d6376bcb8903d369665d4ff48faf5db6
View file https://github.com/jcogs33/codeql/blob/2f8c4df309a177c46aa5d2ad60919ebad815db62/java/ql/lib/semmle/code/java/frameworks/Networking.qll
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/14854/{{ revealButtonHref }}
https://github.com/github/codeql/pull/14854/files#diff-37c821443f7c3273db130299928ca308d6376bcb8903d369665d4ff48faf5db6
https://github.com/github/codeql/pull/14854/files#diff-37c821443f7c3273db130299928ca308d6376bcb8903d369665d4ff48faf5db6
https://github.com/github/codeql/pull/14854/files#diff-37c821443f7c3273db130299928ca308d6376bcb8903d369665d4ff48faf5db6
https://github.com/github/codeql/pull/14854/files#diff-37c821443f7c3273db130299928ca308d6376bcb8903d369665d4ff48faf5db6
https://github.com/github/codeql/blob/main/CODEOWNERS#L16
java/ql/lib/semmle/code/java/security/PathSanitizer.qllhttps://github.com/github/codeql/pull/14854/files#diff-38978229f15815dd860ec9f3696f469770f85b8082736b808072ef64be18a834
View file https://github.com/jcogs33/codeql/blob/2f8c4df309a177c46aa5d2ad60919ebad815db62/java/ql/lib/semmle/code/java/security/PathSanitizer.qll
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/14854/{{ revealButtonHref }}
https://github.com/github/codeql/pull/14854/files#diff-38978229f15815dd860ec9f3696f469770f85b8082736b808072ef64be18a834
Please reload this pagehttps://github.com/github/codeql/pull/14854/files
https://github.com/github/codeql/pull/14854/files#diff-38978229f15815dd860ec9f3696f469770f85b8082736b808072ef64be18a834
https://github.com/github/codeql/blob/main/CODEOWNERS#L16
java/ql/lib/semmle/code/java/security/UrlForwardQuery.qllhttps://github.com/github/codeql/pull/14854/files#diff-8df78ba740135187938580722e32cd4d7312be48a79d76efdb69775d1096175c
View file https://github.com/jcogs33/codeql/blob/2f8c4df309a177c46aa5d2ad60919ebad815db62/java/ql/lib/semmle/code/java/security/UrlForwardQuery.qll
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/14854/{{ revealButtonHref }}
https://github.com/github/codeql/blob/main/CODEOWNERS#L16
java/ql/src/Security/CWE/CWE-552/UrlForward.javahttps://github.com/github/codeql/pull/14854/files#diff-50bdec90d08601bef7feeb33e1f2643a8a4cb8a0a4dc85d03ec0757b9838ec99
View file https://github.com/jcogs33/codeql/blob/2f8c4df309a177c46aa5d2ad60919ebad815db62/java/ql/src/Security/CWE/CWE-552/UrlForward.java
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/14854/{{ revealButtonHref }}
Please reload this pagehttps://github.com/github/codeql/pull/14854/files
https://github.com
Termshttps://docs.github.com/site-policy/github-terms/github-terms-of-service
Privacyhttps://docs.github.com/site-policy/privacy-policies/github-privacy-statement
Securityhttps://github.com/security
Statushttps://www.githubstatus.com/
Communityhttps://github.community/
Docshttps://docs.github.com/
Contacthttps://support.github.com?tags=dotcom-footer

Viewport: width=device-width

URLs of crawlers that visited me.