René's URL Explorer Experiment

Title: Java: Model Spring reactive `WebClient.uri` as a request forgery sink by joshimar · Pull Request #22132 · github/codeql · GitHub

Open Graph Title: Java: Model Spring reactive `WebClient.uri` as a request forgery sink by joshimar · Pull Request #22132 · github/codeql

X Title: Java: Model Spring reactive `WebClient.uri` as a request forgery sink by joshimar · Pull Request #22132 · github/codeql

Description: Spring WebFlux's reactive WebClient sends a request to the URL passed to the per-request uri(...) method (for example webClient.get().uri(url)), declared on WebClient.UriSpec. The request-forgery model covers WebClient.create(url) and WebClient.builder().baseUrl(url). It does not yet cover the per-request uri(...) method, which is the usual way to set a request URL, so a URL built from untrusted input and sent through uri(...) is a java/ssrf sink that is currently unmodeled. Change Adds WebClient$UriSpec.uri as a request-forgery sink: - ["org.springframework.web.reactive.function.client", "WebClient$UriSpec", True, "uri", "", "", "Argument[0]", "request-forgery", "manual"] subtypes is True so the row also applies to RequestHeadersUriSpec and RequestBodyUriSpec, the receiver types returned by get(), post() and similar methods. The signature is left blank to cover all URL-bearing overloads: uri(URI), uri(String, Object...) and uri(String, Map). Testing Validated at three levels. Query tests. ReactiveWebClientSSRF.java adds tainted flows into uri(String) and uri(URI), and RequestForgery.expected is regenerated. The CWE-918 tests pass. True positives (full-build database). Compiled against the Spring WebFlux library, the sink reports untrusted input reaching the request URL: directly, via uri(String); as a URI template, via uri(String, Object...); via a UriComponentsBuilder whose host is attacker-controlled (fromUriString, host). Multi-repository variant analysis. Dataset: 34 popular public Java projects (Spring and WebFlux based), using the CodeQL databases GitHub publishes for them, fetched through the code scanning API. The full list is below: Repositories analyzed (34) alibaba/arthas alibaba/canal alibaba/nacos alibaba/spring-cloud-alibaba apache/dolphinscheduler apache/dubbo apache/rocketmq apache/shenyu apache/skywalking apolloconfig/apollo elunez/eladmin google/guava graphhopper/graphhopper halo-dev/halo jeecgboot/jeecg-boot macrozheng/mall macrozheng/mall-swarm Netflix/zuul openzipkin/zipkin resilience4j/resilience4j sofastack/sofa-boot spring-cloud/spring-cloud-commons spring-cloud/spring-cloud-config spring-cloud/spring-cloud-gateway spring-cloud/spring-cloud-netflix spring-cloud/spring-cloud-openfeign spring-projects/spring-boot spring-projects/spring-framework spring-projects/spring-security square/okhttp thingsboard/thingsboard YunaiV/ruoyi-vue-pro zalando/logbook zhoutaoo/SpringCloud Coverage check: the sink resolves and matches WebClient.uri call sites across the dataset, confirming the run exercises the new model. Result: no alerts, confirming no false positives on the dataset. Overload coverage The blank signature also matches the uri(Function) overload, whose Argument[0] is a builder callback. This matches how other fluent URL setters are modeled. The row can be restricted to the String and URI overloads if preferred.

Open Graph Description: Spring WebFlux's reactive WebClient sends a request to the URL passed to the per-request uri(...) method (for example webClient.get().uri(url)), declared on WebClient.UriSpec. The request-forge...

X Description: Spring WebFlux's reactive WebClient sends a request to the URL passed to the per-request uri(...) method (for example webClient.get().uri(url)), declared on WebClient.UriSpec. The request-f...

Opengraph URL: https://github.com/github/codeql/pull/22132

X: @github

direct link

Domain: github.com

Links:

Viewport: width=device-width