René's URL Explorer Experiment


Title: Java: CWE-552 Add sources and sinks to to detect unsafe getResource calls in Java EE applications by luchua-bc · Pull Request #8706 · github/codeql · GitHub

Open Graph Title: Java: CWE-552 Add sources and sinks to to detect unsafe getResource calls in Java EE applications by luchua-bc · Pull Request #8706 · github/codeql

X Title: Java: CWE-552 Add sources and sinks to to detect unsafe getResource calls in Java EE applications by luchua-bc · Pull Request #8706 · github/codeql

Description: Directly incorporating user input into the getResource call on the server side without proper validation of the input can allow any web application resource such as configuration files and source code to be disclosed. It is very common that Java EE applications load requested resources and return file contents to clients. Constructing a server-side URI path with user input could allow an attacker to download application binaries (including application classes or jar files) or view arbitrary files within protected directories. This query detects unsafe usage of getResource or getResourceAsStream from both servlet context and Java Server Faces context. It utilizes the path sanitizer library to reduce FPs: Path traversal check Path encoding check Check of path normalization using the java.nio.file.Path package Please consider to merge the PR. Thanks.

Open Graph Description: Directly incorporating user input into the getResource call on the server side without proper validation of the input can allow any web application resource such as configuration files and source c...

X Description: Directly incorporating user input into the getResource call on the server side without proper validation of the input can allow any web application resource such as configuration files and source c...

Opengraph URL: https://github.com/github/codeql/pull/8706

X: @github

direct link

Domain: github.com

route-pattern/:user_id/:repository/pull/:id/files(.:format)
route-controllerpull_requests
route-actionfiles
fetch-noncev2:f91ffa54-ea2c-7918-1a7a-bf8c4ff37912
current-catalog-service-hashae870bc5e265a340912cde392f23dad3671a0a881730ffdadd82f2f57d81641b
request-idCB50:3907F1:4371D:57E2A:6A4D2C00
html-safe-nonce19074d882531bab82b0a27f533e5a38ad30c973a193d7daed8e15c34a1d12da5
visitor-payloadeyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiJDQjUwOjM5MDdGMTo0MzcxRDo1N0UyQTo2QTREMkMwMCIsInZpc2l0b3JfaWQiOiI1MTA5Nzc1MTA4Mzk5NzcwNjI0IiwicmVnaW9uX2VkZ2UiOiJpYWQiLCJyZWdpb25fcmVuZGVyIjoiaWFkIn0=
visitor-hmac2face91dfb1923cccc89629b94b0288202cd3be80ff63e711090a198e3b09a46
hovercard-subject-tagpull_request:904353616
github-keyboard-shortcutsrepository,pull-request-list,pull-request-conversation,pull-request-files-changed,copilot
google-site-verificationApib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I
octolytics-urlhttps://collector.github.com/github/collect
analytics-location///pull_requests/show/files
fb:app_id1401488693436528
apple-itunes-appapp-id=1477376905, app-argument=https://github.com/github/codeql/pull/8706/files
twitter:imagehttps://avatars.githubusercontent.com/u/37377780?s=400&v=4
twitter:cardsummary_large_image
og:imagehttps://avatars.githubusercontent.com/u/37377780?s=400&v=4
og:image:altDirectly incorporating user input into the getResource call on the server side without proper validation of the input can allow any web application resource such as configuration files and source c...
og:site_nameGitHub
og:typeobject
hostnamegithub.com
expected-hostnamegithub.com
None92571a8944142227b7e19cd10918b1ddd06e5066c1ad5bc7e4769cf6140a87e6
turbo-cache-controlno-preview
diff-viewunified
go-importgithub.com/github/codeql git https://github.com/github/codeql.git
octolytics-dimension-user_id9919
octolytics-dimension-user_logingithub
octolytics-dimension-repository_id143040428
octolytics-dimension-repository_nwogithub/codeql
octolytics-dimension-repository_publictrue
octolytics-dimension-repository_is_forkfalse
octolytics-dimension-repository_network_root_id143040428
octolytics-dimension-repository_network_root_nwogithub/codeql
turbo-body-classeslogged-out env-production page-responsive full-width
disable-turbotrue
browser-stats-urlhttps://api.github.com/_private/browser/stats
browser-errors-urlhttps://api.github.com/_private/browser/errors
release93f17a978ee60bc4668e1d7b90e6bd2d622261fd
ui-targetfull
theme-color#1e2327
color-schemelight dark

Links:

Skip to contenthttps://github.com/github/codeql/pull/8706/files#start-of-content
https://github.com/
Sign in https://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Fgithub%2Fcodeql%2Fpull%2F8706%2Ffiles
GitHub CopilotWrite better code with AIhttps://github.com/features/copilot
GitHub Copilot appDirect agents from issue to mergehttps://github.com/features/ai/github-app
MCP RegistryNewIntegrate external toolshttps://github.com/mcp
ActionsAutomate any workflowhttps://github.com/features/actions
CodespacesInstant dev environmentshttps://github.com/features/codespaces
IssuesPlan and track workhttps://github.com/features/issues
Code ReviewManage code changeshttps://github.com/features/code-review
GitHub Advanced SecurityFind and fix vulnerabilitieshttps://github.com/security/advanced-security
Code securitySecure your code as you buildhttps://github.com/security/advanced-security/code-security
Secret protectionStop leaks before they starthttps://github.com/security/advanced-security/secret-protection
Why GitHubhttps://github.com/why-github
Documentationhttps://docs.github.com
Bloghttps://github.blog
Changeloghttps://github.blog/changelog
Marketplacehttps://github.com/marketplace
View all featureshttps://github.com/features
Enterpriseshttps://github.com/enterprise
Small and medium teamshttps://github.com/team
Startupshttps://github.com/enterprise/startups
Nonprofitshttps://github.com/solutions/industry/nonprofits
App Modernizationhttps://github.com/solutions/use-case/app-modernization
DevSecOpshttps://github.com/solutions/use-case/devsecops
DevOpshttps://github.com/solutions/use-case/devops
CI/CDhttps://github.com/solutions/use-case/ci-cd
View all use caseshttps://github.com/solutions/use-case
Healthcarehttps://github.com/solutions/industry/healthcare
Financial serviceshttps://github.com/solutions/industry/financial-services
Manufacturinghttps://github.com/solutions/industry/manufacturing
Governmenthttps://github.com/solutions/industry/government
View all industrieshttps://github.com/solutions/industry
View all solutionshttps://github.com/solutions
AIhttps://github.com/resources/articles?topic=ai
Software Developmenthttps://github.com/resources/articles?topic=software-development
DevOpshttps://github.com/resources/articles?topic=devops
Securityhttps://github.com/resources/articles?topic=security
View all topicshttps://github.com/resources/articles
Customer storieshttps://github.com/customer-stories
Events & webinarshttps://github.com/resources/events
Ebooks & reportshttps://github.com/resources/whitepapers
Business insightshttps://github.com/solutions/executive-insights
GitHub Skillshttps://skills.github.com
Documentationhttps://docs.github.com
Customer supporthttps://support.github.com
Community forumhttps://github.com/orgs/community/discussions
Trust centerhttps://github.com/trust-center
Partnershttps://github.com/partners
View all resourceshttps://github.com/resources
GitHub SponsorsFund open source developershttps://github.com/sponsors
Security Labhttps://securitylab.github.com
Maintainer Communityhttps://maintainers.github.com
Acceleratorhttps://github.com/accelerator
GitHub Starshttps://stars.github.com
Archive Programhttps://archiveprogram.github.com
Topicshttps://github.com/topics
Trendinghttps://github.com/trending
Collectionshttps://github.com/collections
Enterprise platformAI-powered developer platformhttps://github.com/enterprise
GitHub Advanced SecurityEnterprise-grade security featureshttps://github.com/security/advanced-security
Copilot for BusinessEnterprise-grade AI featureshttps://github.com/features/copilot/copilot-business
Premium SupportEnterprise-grade 24/7 supporthttps://github.com/premium-support
Pricinghttps://github.com/pricing
Search syntax tipshttps://docs.github.com/search-github/github-code-search/understanding-github-code-search-syntax
documentationhttps://docs.github.com/search-github/github-code-search/understanding-github-code-search-syntax
Sign in https://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Fgithub%2Fcodeql%2Fpull%2F8706%2Ffiles
Sign up https://github.com/signup?ref_cta=Sign+up&ref_loc=header+logged+out&ref_page=%2F%3Cuser-name%3E%2F%3Crepo-name%3E%2Fpull_requests%2Fshow%2Ffiles&source=header-repo&source_repo=github%2Fcodeql
Reloadhttps://github.com/github/codeql/pull/8706/files
Reloadhttps://github.com/github/codeql/pull/8706/files
Reloadhttps://github.com/github/codeql/pull/8706/files
Please reload this pagehttps://github.com/github/codeql/pull/8706/files
github https://github.com/github
codeqlhttps://github.com/github/codeql
Notifications https://github.com/login?return_to=%2Fgithub%2Fcodeql
Fork 2k https://github.com/login?return_to=%2Fgithub%2Fcodeql
Star 9.8k https://github.com/login?return_to=%2Fgithub%2Fcodeql
Code https://github.com/github/codeql
Issues 987 https://github.com/github/codeql/issues
Pull requests 424 https://github.com/github/codeql/pulls
Discussions https://github.com/github/codeql/discussions
Actions https://github.com/github/codeql/actions
Projects https://github.com/github/codeql/projects
Models https://github.com/github/codeql/models
Security and quality 0 https://github.com/github/codeql/security
Insights https://github.com/github/codeql/pulse
Code https://github.com/github/codeql
Issues https://github.com/github/codeql/issues
Pull requests https://github.com/github/codeql/pulls
Discussions https://github.com/github/codeql/discussions
Actions https://github.com/github/codeql/actions
Projects https://github.com/github/codeql/projects
Models https://github.com/github/codeql/models
Security and quality https://github.com/github/codeql/security
Insights https://github.com/github/codeql/pulse
Sign up for GitHub https://github.com/signup?return_to=%2Fgithub%2Fcodeql%2Fissues%2Fnew%2Fchoose
terms of servicehttps://docs.github.com/terms
privacy statementhttps://docs.github.com/privacy
Sign inhttps://github.com/login?return_to=%2Fgithub%2Fcodeql%2Fissues%2Fnew%2Fchoose
atorralbahttps://github.com/atorralba
github:mainhttps://github.com/github/codeql/tree/main
luchua-bc:java/unsafe-get-resourcehttps://github.com/luchua-bc/ql/tree/java/unsafe-get-resource
Conversation 39 https://github.com/github/codeql/pull/8706
Findings https://github.com/github/codeql/pull/8706/findings
Commits 8 https://github.com/github/codeql/pull/8706/commits
Checks 0 https://github.com/github/codeql/pull/8706/checks
Files changed https://github.com/github/codeql/pull/8706/files
Please reload this pagehttps://github.com/github/codeql/pull/8706/files
Java: CWE-552 Add sources and sinks to to detect unsafe getResource calls in Java EE applications https://github.com/github/codeql/pull/8706/files#top
Show all changes 8 commits https://github.com/github/codeql/pull/8706/files
eccd97c Query to detect unsafe getResource calls in Java EE applications luchua-bc Apr 9, 2022 https://github.com/github/codeql/pull/8706/commits/eccd97c7b7caf33d44ee18e60b7096781ac10585
7029802 Add sinks for getClass() and getClassLoader() luchua-bc Apr 11, 2022 https://github.com/github/codeql/pull/8706/commits/7029802f3bf40e50626725b4680863588b00a881
f0c4b19 Change getResource() to be a taint step luchua-bc Apr 19, 2022 https://github.com/github/codeql/pull/8706/commits/f0c4b1955b1f70115b5b6027eb4e64bc8ebb0cad
b76873f Add more test cases luchua-bc Apr 19, 2022 https://github.com/github/codeql/pull/8706/commits/b76873fc8dfb1878ac6c2586559b613245f93557
e99cee4 Merge branch 'main' into java/unsafe-get-resource atorralba Apr 27, 2022 https://github.com/github/codeql/pull/8706/commits/e99cee49134ea8ea9d7b5fc815a2d72e855523f0
590b9d8 Standardize the query and update qldoc luchua-bc Apr 27, 2022 https://github.com/github/codeql/pull/8706/commits/590b9d8519a1a58a9d38059b566a8b940ee7eed0
0aa1251 Add more test cases luchua-bc Apr 29, 2022 https://github.com/github/codeql/pull/8706/commits/0aa1251ffe47a396224db32e8d72a5d7beaf42ad
920a7cd Put back the taint step removed during merge luchua-bc Apr 29, 2022 https://github.com/github/codeql/pull/8706/commits/920a7cd2e62e69886516e67e55a7b4295b7725e1
Clear filters https://github.com/github/codeql/pull/8706/files
Please reload this pagehttps://github.com/github/codeql/pull/8706/files
Please reload this pagehttps://github.com/github/codeql/pull/8706/files
Servlets.qll https://github.com/github/codeql/pull/8706/files#diff-33368733f046f32b4d0f28bebe9c0451ca1ce54376de355f82992b8b82f63083
UnsafeResourceGet.java https://github.com/github/codeql/pull/8706/files#diff-f94b0a2672fcbdadc8d612e674ac08eac46361fe25079506cad2cca37a6d5397
UnsafeUrlForward.qhelp https://github.com/github/codeql/pull/8706/files#diff-3e5cfcc60b5abc0126d377789c00f2606f31d2cb303c412acca9c927e0a0d722
UnsafeUrlForward.ql https://github.com/github/codeql/pull/8706/files#diff-3caec98bb63246165cd000f9dbbac654f2cd460af72d62cc2b6c0001f62eaf5e
UnsafeUrlForward.qll https://github.com/github/codeql/pull/8706/files#diff-171b613f67732add15b5c1b18e1c983ed4522338e7debe776016bcd4f13ffcba
Jsf.qll https://github.com/github/codeql/pull/8706/files#diff-0c6be434415f2f1258b194808ec166a5b14b0027cc641504e9d79f0f579c888c
UnsafeResourceGet.java https://github.com/github/codeql/pull/8706/files#diff-53935816105637af9dd5b1066a1bb40281477452fc11651e1cf77fe92a2fed28
UnsafeResourceGet2.java https://github.com/github/codeql/pull/8706/files#diff-257d785825362eb6a2cfd0e6af0275f21f5ad35a54d103b53e0f33a02572f387
UnsafeUrlForward.expected https://github.com/github/codeql/pull/8706/files#diff-cee29b69dfd9b0b1243fd0589f66ac94dfd0c3b43cd5de6892331df28db85f95
options https://github.com/github/codeql/pull/8706/files#diff-a23d6723ceb9ac152050ee8f7d948a8b29e6f3b36a0143e4f85a7272e62e5d0c
VFS.java https://github.com/github/codeql/pull/8706/files#diff-c27ad9d09c2cb6b1dcfe0fe6cfce0b49fd99e9053140031caf07e1ad05fe59b5
VirtualFile.java https://github.com/github/codeql/pull/8706/files#diff-6e2cef9b11535640a5d3c496a39022e8e335339521ee5849f0d71db90ffcd3cf
FileResourceManager.java https://github.com/github/codeql/pull/8706/files#diff-c8de518427e661c3aaafdafffd0a731eceab3378e88adcd2a85fad1f3aa9679c
Resource.java https://github.com/github/codeql/pull/8706/files#diff-9bc7a0060e7ae212c677dee908fbd699835ed293a0ad291a27cf50635d90e37a
https://github.com/github/codeql/blob/main/CODEOWNERS#L16
java/ql/lib/semmle/code/java/frameworks/Servlets.qllhttps://github.com/github/codeql/pull/8706/files#diff-33368733f046f32b4d0f28bebe9c0451ca1ce54376de355f82992b8b82f63083
View file https://github.com/luchua-bc/ql/blob/920a7cd2e62e69886516e67e55a7b4295b7725e1/java/ql/lib/semmle/code/java/frameworks/Servlets.qll
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/8706/{{ revealButtonHref }}
https://github.com/github/codeql/pull/8706/files#diff-33368733f046f32b4d0f28bebe9c0451ca1ce54376de355f82992b8b82f63083
https://github.com/github/codeql/blob/main/CODEOWNERS#L16
java/ql/src/experimental/Security/CWE/CWE-552/UnsafeResourceGet.javahttps://github.com/github/codeql/pull/8706/files#diff-f94b0a2672fcbdadc8d612e674ac08eac46361fe25079506cad2cca37a6d5397
View file https://github.com/luchua-bc/ql/blob/920a7cd2e62e69886516e67e55a7b4295b7725e1/java/ql/src/experimental/Security/CWE/CWE-552/UnsafeResourceGet.java
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/8706/{{ revealButtonHref }}
Please reload this pagehttps://github.com/github/codeql/pull/8706/files
https://github.com/github/codeql/blob/main/CODEOWNERS#L16
java/ql/src/experimental/Security/CWE/CWE-552/UnsafeUrlForward.qhelphttps://github.com/github/codeql/pull/8706/files#diff-3e5cfcc60b5abc0126d377789c00f2606f31d2cb303c412acca9c927e0a0d722
View file https://github.com/luchua-bc/ql/blob/920a7cd2e62e69886516e67e55a7b4295b7725e1/java/ql/src/experimental/Security/CWE/CWE-552/UnsafeUrlForward.qhelp
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/8706/{{ revealButtonHref }}
https://github.com/github/codeql/pull/8706/files#diff-3e5cfcc60b5abc0126d377789c00f2606f31d2cb303c412acca9c927e0a0d722
https://github.com/github/codeql/pull/8706/files#diff-3e5cfcc60b5abc0126d377789c00f2606f31d2cb303c412acca9c927e0a0d722
https://github.com/github/codeql/blob/main/CODEOWNERS#L16
java/ql/src/experimental/Security/CWE/CWE-552/UnsafeUrlForward.qlhttps://github.com/github/codeql/pull/8706/files#diff-3caec98bb63246165cd000f9dbbac654f2cd460af72d62cc2b6c0001f62eaf5e
View file https://github.com/luchua-bc/ql/blob/920a7cd2e62e69886516e67e55a7b4295b7725e1/java/ql/src/experimental/Security/CWE/CWE-552/UnsafeUrlForward.ql
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/8706/{{ revealButtonHref }}
https://github.com/github/codeql/pull/8706/files#diff-3caec98bb63246165cd000f9dbbac654f2cd460af72d62cc2b6c0001f62eaf5e
https://github.com/github/codeql/pull/8706/files#diff-3caec98bb63246165cd000f9dbbac654f2cd460af72d62cc2b6c0001f62eaf5e
https://github.com/github/codeql/pull/8706/files#diff-3caec98bb63246165cd000f9dbbac654f2cd460af72d62cc2b6c0001f62eaf5e
Please reload this pagehttps://github.com/github/codeql/pull/8706/files
Please reload this pagehttps://github.com/github/codeql/pull/8706/files
https://github.com/github/codeql/pull/8706/files#diff-3caec98bb63246165cd000f9dbbac654f2cd460af72d62cc2b6c0001f62eaf5e
https://github.com/github/codeql/blob/main/CODEOWNERS#L16
java/ql/src/experimental/Security/CWE/CWE-552/UnsafeUrlForward.qllhttps://github.com/github/codeql/pull/8706/files#diff-171b613f67732add15b5c1b18e1c983ed4522338e7debe776016bcd4f13ffcba
View file https://github.com/luchua-bc/ql/blob/920a7cd2e62e69886516e67e55a7b4295b7725e1/java/ql/src/experimental/Security/CWE/CWE-552/UnsafeUrlForward.qll
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/8706/{{ revealButtonHref }}
https://github.com/github/codeql/pull/8706/files#diff-171b613f67732add15b5c1b18e1c983ed4522338e7debe776016bcd4f13ffcba
https://github.com/github/codeql/pull/8706/files#diff-171b613f67732add15b5c1b18e1c983ed4522338e7debe776016bcd4f13ffcba
https://github.com/github/codeql/pull/8706/files#diff-171b613f67732add15b5c1b18e1c983ed4522338e7debe776016bcd4f13ffcba
https://github.com/github/codeql/blob/main/CODEOWNERS#L16
java/ql/src/experimental/semmle/code/java/frameworks/Jsf.qllhttps://github.com/github/codeql/pull/8706/files#diff-0c6be434415f2f1258b194808ec166a5b14b0027cc641504e9d79f0f579c888c
View file https://github.com/luchua-bc/ql/blob/920a7cd2e62e69886516e67e55a7b4295b7725e1/java/ql/src/experimental/semmle/code/java/frameworks/Jsf.qll
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/8706/{{ revealButtonHref }}
Please reload this pagehttps://github.com/github/codeql/pull/8706/files
https://github.com
Termshttps://docs.github.com/site-policy/github-terms/github-terms-of-service
Privacyhttps://docs.github.com/site-policy/privacy-policies/github-privacy-statement
Securityhttps://github.com/security
Statushttps://www.githubstatus.com/
Communityhttps://github.community/
Docshttps://docs.github.com/
Contacthttps://support.github.com?tags=dotcom-footer

Viewport: width=device-width


URLs of crawlers that visited me.