Title: Java: CWE-552 Add sources and sinks to to detect unsafe getResource calls in Java EE applications by luchua-bc · Pull Request #8706 · github/codeql · GitHub
Open Graph Title: Java: CWE-552 Add sources and sinks to to detect unsafe getResource calls in Java EE applications by luchua-bc · Pull Request #8706 · github/codeql
X Title: Java: CWE-552 Add sources and sinks to to detect unsafe getResource calls in Java EE applications by luchua-bc · Pull Request #8706 · github/codeql
Description: Directly incorporating user input into the getResource call on the server side without proper validation of the input can allow any web application resource such as configuration files and source code to be disclosed. It is very common that Java EE applications load requested resources and return file contents to clients. Constructing a server-side URI path with user input could allow an attacker to download application binaries (including application classes or jar files) or view arbitrary files within protected directories. This query detects unsafe usage of getResource or getResourceAsStream from both servlet context and Java Server Faces context. It utilizes the path sanitizer library to reduce FPs: Path traversal check Path encoding check Check of path normalization using the java.nio.file.Path package Please consider to merge the PR. Thanks.
Open Graph Description: Directly incorporating user input into the getResource call on the server side without proper validation of the input can allow any web application resource such as configuration files and source c...
X Description: Directly incorporating user input into the getResource call on the server side without proper validation of the input can allow any web application resource such as configuration files and source c...
Opengraph URL: https://github.com/github/codeql/pull/8706
X: @github
Domain: github.com
| route-pattern | /:user_id/:repository/pull/:id/files(.:format) |
| route-controller | pull_requests |
| route-action | files |
| fetch-nonce | v2:f91ffa54-ea2c-7918-1a7a-bf8c4ff37912 |
| current-catalog-service-hash | ae870bc5e265a340912cde392f23dad3671a0a881730ffdadd82f2f57d81641b |
| request-id | CB50:3907F1:4371D:57E2A:6A4D2C00 |
| html-safe-nonce | 19074d882531bab82b0a27f533e5a38ad30c973a193d7daed8e15c34a1d12da5 |
| visitor-payload | eyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiJDQjUwOjM5MDdGMTo0MzcxRDo1N0UyQTo2QTREMkMwMCIsInZpc2l0b3JfaWQiOiI1MTA5Nzc1MTA4Mzk5NzcwNjI0IiwicmVnaW9uX2VkZ2UiOiJpYWQiLCJyZWdpb25fcmVuZGVyIjoiaWFkIn0= |
| visitor-hmac | 2face91dfb1923cccc89629b94b0288202cd3be80ff63e711090a198e3b09a46 |
| hovercard-subject-tag | pull_request:904353616 |
| github-keyboard-shortcuts | repository,pull-request-list,pull-request-conversation,pull-request-files-changed,copilot |
| google-site-verification | Apib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I |
| octolytics-url | https://collector.github.com/github/collect |
| analytics-location | / |
| fb:app_id | 1401488693436528 |
| apple-itunes-app | app-id=1477376905, app-argument=https://github.com/github/codeql/pull/8706/files |
| twitter:image | https://avatars.githubusercontent.com/u/37377780?s=400&v=4 |
| twitter:card | summary_large_image |
| og:image | https://avatars.githubusercontent.com/u/37377780?s=400&v=4 |
| og:image:alt | Directly incorporating user input into the getResource call on the server side without proper validation of the input can allow any web application resource such as configuration files and source c... |
| og:site_name | GitHub |
| og:type | object |
| hostname | github.com |
| expected-hostname | github.com |
| None | 92571a8944142227b7e19cd10918b1ddd06e5066c1ad5bc7e4769cf6140a87e6 |
| turbo-cache-control | no-preview |
| diff-view | unified |
| go-import | github.com/github/codeql git https://github.com/github/codeql.git |
| octolytics-dimension-user_id | 9919 |
| octolytics-dimension-user_login | github |
| octolytics-dimension-repository_id | 143040428 |
| octolytics-dimension-repository_nwo | github/codeql |
| octolytics-dimension-repository_public | true |
| octolytics-dimension-repository_is_fork | false |
| octolytics-dimension-repository_network_root_id | 143040428 |
| octolytics-dimension-repository_network_root_nwo | github/codeql |
| turbo-body-classes | logged-out env-production page-responsive full-width |
| disable-turbo | true |
| browser-stats-url | https://api.github.com/_private/browser/stats |
| browser-errors-url | https://api.github.com/_private/browser/errors |
| release | 93f17a978ee60bc4668e1d7b90e6bd2d622261fd |
| ui-target | full |
| theme-color | #1e2327 |
| color-scheme | light dark |
Links:
Viewport: width=device-width