Title: Java: CWE-552 Query to detect configuration file/source code exposure from unsafe request dispatcher by luchua-bc · Pull Request #6251 · github/codeql · GitHub
Open Graph Title: Java: CWE-552 Query to detect configuration file/source code exposure from unsafe request dispatcher by luchua-bc · Pull Request #6251 · github/codeql
X Title: Java: CWE-552 Query to detect configuration file/source code exposure from unsafe request dispatcher by luchua-bc · Pull Request #6251 · github/codeql
Description: Directly incorporating user input into HTTP requests dispatched from the Java EE RequestDispatcher without validating the input can allow any web application resource such as configuration files and source code to be disclosed. As stated in the Java API doc, when using a Java EE RequestDispatcher, requests may be dispatched to any part of the web application bypassing both implicit (no direct access to WEB-INF or META-INF) and explicit (defined by the web application) security constraints. Unsanitized user provided data must not be used to construct the path passed to the RequestDispatcher as it is very likely to create a security vulnerability in the application. This query detects unsafe invocations of RequestDispatcher with user controlled input. Please consider to merge the PR. Thanks.
Open Graph Description: Directly incorporating user input into HTTP requests dispatched from the Java EE RequestDispatcher without validating the input can allow any web application resource such as configuration files a...
X Description: Directly incorporating user input into HTTP requests dispatched from the Java EE RequestDispatcher without validating the input can allow any web application resource such as configuration files a...
Opengraph URL: https://github.com/github/codeql/pull/6251
X: @github
Domain: github.com
| route-pattern | /:user_id/:repository/pull/:id/files(.:format) |
| route-controller | pull_requests |
| route-action | files |
| fetch-nonce | v2:adffdf13-376e-65b1-8339-32d52c18bfe2 |
| current-catalog-service-hash | ae870bc5e265a340912cde392f23dad3671a0a881730ffdadd82f2f57d81641b |
| request-id | A0A4:2630A2:23E7883:32B2138:6A4CE2A1 |
| html-safe-nonce | f95ee0fc41e144eaa05e68cb530be84d524e75289022179016e7d24afd53bed4 |
| visitor-payload | eyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiJBMEE0OjI2MzBBMjoyM0U3ODgzOjMyQjIxMzg6NkE0Q0UyQTEiLCJ2aXNpdG9yX2lkIjoiODIzMzY2ODQ5OTY4OTIzNTEwNSIsInJlZ2lvbl9lZGdlIjoiaWFkIiwicmVnaW9uX3JlbmRlciI6ImlhZCJ9 |
| visitor-hmac | fb8e99f796258631b45d1234f461dda7830dc086f89c639206c7273566bf469f |
| hovercard-subject-tag | pull_request:687391566 |
| github-keyboard-shortcuts | repository,pull-request-list,pull-request-conversation,pull-request-files-changed,copilot |
| google-site-verification | Apib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I |
| octolytics-url | https://collector.github.com/github/collect |
| analytics-location | / |
| fb:app_id | 1401488693436528 |
| apple-itunes-app | app-id=1477376905, app-argument=https://github.com/github/codeql/pull/6251/files |
| twitter:image | https://avatars.githubusercontent.com/u/37377780?s=400&v=4 |
| twitter:card | summary_large_image |
| og:image | https://avatars.githubusercontent.com/u/37377780?s=400&v=4 |
| og:image:alt | Directly incorporating user input into HTTP requests dispatched from the Java EE RequestDispatcher without validating the input can allow any web application resource such as configuration files a... |
| og:site_name | GitHub |
| og:type | object |
| hostname | github.com |
| expected-hostname | github.com |
| None | 299b43bca6e02ad35197ffeba30d2466846d5fb02ab96fbced5b5e6cec589fb8 |
| turbo-cache-control | no-preview |
| diff-view | unified |
| go-import | github.com/github/codeql git https://github.com/github/codeql.git |
| octolytics-dimension-user_id | 9919 |
| octolytics-dimension-user_login | github |
| octolytics-dimension-repository_id | 143040428 |
| octolytics-dimension-repository_nwo | github/codeql |
| octolytics-dimension-repository_public | true |
| octolytics-dimension-repository_is_fork | false |
| octolytics-dimension-repository_network_root_id | 143040428 |
| octolytics-dimension-repository_network_root_nwo | github/codeql |
| turbo-body-classes | logged-out env-production page-responsive full-width |
| disable-turbo | true |
| browser-stats-url | https://api.github.com/_private/browser/stats |
| browser-errors-url | https://api.github.com/_private/browser/errors |
| release | c5a57f04eeb310f57c73fd6d751d957e2ca27ed2 |
| ui-target | full |
| theme-color | #1e2327 |
| color-scheme | light dark |
Links:
Viewport: width=device-width