René's URL Explorer Experiment


Title: Java: CWE-552 Query to detect unsafe resource loading in Java Spring applications by luchua-bc · Pull Request #9199 · github/codeql · GitHub

Open Graph Title: Java: CWE-552 Query to detect unsafe resource loading in Java Spring applications by luchua-bc · Pull Request #9199 · github/codeql

X Title: Java: CWE-552 Query to detect unsafe resource loading in Java Spring applications by luchua-bc · Pull Request #9199 · github/codeql

Description: Directly incorporating user input into loading resource calls on the server side without proper validation of the input can allow any web application resource such as configuration files and source code to be disclosed. It is very common that Java Spring applications load requested resources and return file contents to clients. Constructing a server-side URI path with user input could allow an attacker to download application binaries (including application classes or jar files) or view arbitrary files within protected directories. This query detects unsafe usage of resource loading in Spring including the following APIs: ClassPathResource ResourceUtils ResourceLoader and ApplicationContext It utilizes the path sanitizer library to reduce FPs: Path traversal check Path encoding check Check of path normalization using the java.nio.file.Path package Please consider to merge the PR. Thanks.

Open Graph Description: Directly incorporating user input into loading resource calls on the server side without proper validation of the input can allow any web application resource such as configuration files and source...

X Description: Directly incorporating user input into loading resource calls on the server side without proper validation of the input can allow any web application resource such as configuration files and source...

Opengraph URL: https://github.com/github/codeql/pull/9199

X: @github

direct link

Domain: github.com

route-pattern/:user_id/:repository/pull/:id/files(.:format)
route-controllerpull_requests
route-actionfiles
fetch-noncev2:8b7fca0d-6fbe-4b2f-b77c-d885f67b0021
current-catalog-service-hashae870bc5e265a340912cde392f23dad3671a0a881730ffdadd82f2f57d81641b
request-idD978:42BF6:6F407F:955775:6A4D37E0
html-safe-nonce633a4a29390714dc403f25886d89d6928cffefb2eaf52d1f7c9b52b089e2e921
visitor-payloadeyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiJEOTc4OjQyQkY2OjZGNDA3Rjo5NTU3NzU6NkE0RDM3RTAiLCJ2aXNpdG9yX2lkIjoiMzMxNDQ5MDU3MjY1MTk2ODQ4MSIsInJlZ2lvbl9lZGdlIjoiaWFkIiwicmVnaW9uX3JlbmRlciI6ImlhZCJ9
visitor-hmacb64e41ea98375e8d27e83d914c34f78bc9e6948944ed6384498f95e0eb64d13a
hovercard-subject-tagpull_request:938982069
github-keyboard-shortcutsrepository,pull-request-list,pull-request-conversation,pull-request-files-changed,copilot
google-site-verificationApib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I
octolytics-urlhttps://collector.github.com/github/collect
analytics-location///pull_requests/show/files
fb:app_id1401488693436528
apple-itunes-appapp-id=1477376905, app-argument=https://github.com/github/codeql/pull/9199/files
twitter:imagehttps://avatars.githubusercontent.com/u/37377780?s=400&v=4
twitter:cardsummary_large_image
og:imagehttps://avatars.githubusercontent.com/u/37377780?s=400&v=4
og:image:altDirectly incorporating user input into loading resource calls on the server side without proper validation of the input can allow any web application resource such as configuration files and source...
og:site_nameGitHub
og:typeobject
hostnamegithub.com
expected-hostnamegithub.com
None92571a8944142227b7e19cd10918b1ddd06e5066c1ad5bc7e4769cf6140a87e6
turbo-cache-controlno-preview
diff-viewunified
go-importgithub.com/github/codeql git https://github.com/github/codeql.git
octolytics-dimension-user_id9919
octolytics-dimension-user_logingithub
octolytics-dimension-repository_id143040428
octolytics-dimension-repository_nwogithub/codeql
octolytics-dimension-repository_publictrue
octolytics-dimension-repository_is_forkfalse
octolytics-dimension-repository_network_root_id143040428
octolytics-dimension-repository_network_root_nwogithub/codeql
turbo-body-classeslogged-out env-production page-responsive full-width
disable-turbotrue
browser-stats-urlhttps://api.github.com/_private/browser/stats
browser-errors-urlhttps://api.github.com/_private/browser/errors
release56fc8347865a14e2ec811533d68f929cf4e0ec19
ui-targetfull
theme-color#1e2327
color-schemelight dark

Links:

Skip to contenthttps://github.com/github/codeql/pull/9199/files#start-of-content
https://github.com/
Sign in https://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Fgithub%2Fcodeql%2Fpull%2F9199%2Ffiles
GitHub CopilotWrite better code with AIhttps://github.com/features/copilot
GitHub Copilot appDirect agents from issue to mergehttps://github.com/features/ai/github-app
MCP RegistryNewIntegrate external toolshttps://github.com/mcp
ActionsAutomate any workflowhttps://github.com/features/actions
CodespacesInstant dev environmentshttps://github.com/features/codespaces
IssuesPlan and track workhttps://github.com/features/issues
Code ReviewManage code changeshttps://github.com/features/code-review
GitHub Advanced SecurityFind and fix vulnerabilitieshttps://github.com/security/advanced-security
Code securitySecure your code as you buildhttps://github.com/security/advanced-security/code-security
Secret protectionStop leaks before they starthttps://github.com/security/advanced-security/secret-protection
Why GitHubhttps://github.com/why-github
Documentationhttps://docs.github.com
Bloghttps://github.blog
Changeloghttps://github.blog/changelog
Marketplacehttps://github.com/marketplace
View all featureshttps://github.com/features
Enterpriseshttps://github.com/enterprise
Small and medium teamshttps://github.com/team
Startupshttps://github.com/enterprise/startups
Nonprofitshttps://github.com/solutions/industry/nonprofits
App Modernizationhttps://github.com/solutions/use-case/app-modernization
DevSecOpshttps://github.com/solutions/use-case/devsecops
DevOpshttps://github.com/solutions/use-case/devops
CI/CDhttps://github.com/solutions/use-case/ci-cd
View all use caseshttps://github.com/solutions/use-case
Healthcarehttps://github.com/solutions/industry/healthcare
Financial serviceshttps://github.com/solutions/industry/financial-services
Manufacturinghttps://github.com/solutions/industry/manufacturing
Governmenthttps://github.com/solutions/industry/government
View all industrieshttps://github.com/solutions/industry
View all solutionshttps://github.com/solutions
AIhttps://github.com/resources/articles?topic=ai
Software Developmenthttps://github.com/resources/articles?topic=software-development
DevOpshttps://github.com/resources/articles?topic=devops
Securityhttps://github.com/resources/articles?topic=security
View all topicshttps://github.com/resources/articles
Customer storieshttps://github.com/customer-stories
Events & webinarshttps://github.com/resources/events
Ebooks & reportshttps://github.com/resources/whitepapers
Business insightshttps://github.com/solutions/executive-insights
GitHub Skillshttps://skills.github.com
Documentationhttps://docs.github.com
Customer supporthttps://support.github.com
Community forumhttps://github.com/orgs/community/discussions
Trust centerhttps://github.com/trust-center
Partnershttps://github.com/partners
View all resourceshttps://github.com/resources
GitHub SponsorsFund open source developershttps://github.com/sponsors
Security Labhttps://securitylab.github.com
Maintainer Communityhttps://maintainers.github.com
Acceleratorhttps://github.com/accelerator
GitHub Starshttps://stars.github.com
Archive Programhttps://archiveprogram.github.com
Topicshttps://github.com/topics
Trendinghttps://github.com/trending
Collectionshttps://github.com/collections
Enterprise platformAI-powered developer platformhttps://github.com/enterprise
GitHub Advanced SecurityEnterprise-grade security featureshttps://github.com/security/advanced-security
Copilot for BusinessEnterprise-grade AI featureshttps://github.com/features/copilot/copilot-business
Premium SupportEnterprise-grade 24/7 supporthttps://github.com/premium-support
Pricinghttps://github.com/pricing
Search syntax tipshttps://docs.github.com/search-github/github-code-search/understanding-github-code-search-syntax
documentationhttps://docs.github.com/search-github/github-code-search/understanding-github-code-search-syntax
Sign in https://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Fgithub%2Fcodeql%2Fpull%2F9199%2Ffiles
Sign up https://github.com/signup?ref_cta=Sign+up&ref_loc=header+logged+out&ref_page=%2F%3Cuser-name%3E%2F%3Crepo-name%3E%2Fpull_requests%2Fshow%2Ffiles&source=header-repo&source_repo=github%2Fcodeql
Reloadhttps://github.com/github/codeql/pull/9199/files
Reloadhttps://github.com/github/codeql/pull/9199/files
Reloadhttps://github.com/github/codeql/pull/9199/files
Please reload this pagehttps://github.com/github/codeql/pull/9199/files
github https://github.com/github
codeqlhttps://github.com/github/codeql
Notifications https://github.com/login?return_to=%2Fgithub%2Fcodeql
Fork 2k https://github.com/login?return_to=%2Fgithub%2Fcodeql
Star 9.8k https://github.com/login?return_to=%2Fgithub%2Fcodeql
Code https://github.com/github/codeql
Issues 987 https://github.com/github/codeql/issues
Pull requests 424 https://github.com/github/codeql/pulls
Discussions https://github.com/github/codeql/discussions
Actions https://github.com/github/codeql/actions
Projects https://github.com/github/codeql/projects
Models https://github.com/github/codeql/models
Security and quality 0 https://github.com/github/codeql/security
Insights https://github.com/github/codeql/pulse
Code https://github.com/github/codeql
Issues https://github.com/github/codeql/issues
Pull requests https://github.com/github/codeql/pulls
Discussions https://github.com/github/codeql/discussions
Actions https://github.com/github/codeql/actions
Projects https://github.com/github/codeql/projects
Models https://github.com/github/codeql/models
Security and quality https://github.com/github/codeql/security
Insights https://github.com/github/codeql/pulse
Sign up for GitHub https://github.com/signup?return_to=%2Fgithub%2Fcodeql%2Fissues%2Fnew%2Fchoose
terms of servicehttps://docs.github.com/terms
privacy statementhttps://docs.github.com/privacy
Sign inhttps://github.com/login?return_to=%2Fgithub%2Fcodeql%2Fissues%2Fnew%2Fchoose
atorralbahttps://github.com/atorralba
github:mainhttps://github.com/github/codeql/tree/main
luchua-bc:java/unsafe-url-forward-dispatch-loadhttps://github.com/luchua-bc/ql/tree/java/unsafe-url-forward-dispatch-load
Conversation 32 https://github.com/github/codeql/pull/9199
Findings https://github.com/github/codeql/pull/9199/findings
Commits 6 https://github.com/github/codeql/pull/9199/commits
Checks 0 https://github.com/github/codeql/pull/9199/checks
Files changed https://github.com/github/codeql/pull/9199/files
Please reload this pagehttps://github.com/github/codeql/pull/9199/files
Java: CWE-552 Query to detect unsafe resource loading in Java Spring applications https://github.com/github/codeql/pull/9199/files#top
Show all changes 6 commits https://github.com/github/codeql/pull/9199/files
311c9e4 Query to detect unsafe resource loading in Java Spring applications luchua-bc May 17, 2022 https://github.com/github/codeql/pull/9199/commits/311c9e47191a06b905c09cd448fef4de565a92a0
b357274 Simplify test case and minor update to the query luchua-bc Jun 21, 2022 https://github.com/github/codeql/pull/9199/commits/b3572747f01ad9b9b06f144f293daf316da4ce67
251f67d Use the new CSV model luchua-bc Jun 22, 2022 https://github.com/github/codeql/pull/9199/commits/251f67dcf375237b3b0847a8c39957628af5d768
e33d786 Add test cases and reduce FPs luchua-bc Jul 1, 2022 https://github.com/github/codeql/pull/9199/commits/e33d78674565b64f9ef4ab2001b49bfd5b29b3c0
8effbff Remove unused code and update qldoc luchua-bc Sep 23, 2022 https://github.com/github/codeql/pull/9199/commits/8effbff817e87db04e73976e3634ed3173a563ca
7ff82bb Update java/ql/src/experimental/Security/CWE/CWE-552/UnsafeUrlForward… atorralba Sep 27, 2022 https://github.com/github/codeql/pull/9199/commits/7ff82bbed35282d8040b8bf5db9d0225f866b059
Clear filters https://github.com/github/codeql/pull/9199/files
Please reload this pagehttps://github.com/github/codeql/pull/9199/files
Please reload this pagehttps://github.com/github/codeql/pull/9199/files
UnsafeLoadSpringResource.java https://github.com/github/codeql/pull/9199/files#diff-0e56fadcb29ab30b8b9a36beaad4289e301d09577007be05b125446192c5ba01
UnsafeUrlForward.qhelp https://github.com/github/codeql/pull/9199/files#diff-3e5cfcc60b5abc0126d377789c00f2606f31d2cb303c412acca9c927e0a0d722
UnsafeUrlForward.ql https://github.com/github/codeql/pull/9199/files#diff-3caec98bb63246165cd000f9dbbac654f2cd460af72d62cc2b6c0001f62eaf5e
UnsafeUrlForward.qll https://github.com/github/codeql/pull/9199/files#diff-171b613f67732add15b5c1b18e1c983ed4522338e7debe776016bcd4f13ffcba
SpringResource.qll https://github.com/github/codeql/pull/9199/files#diff-68b35a808b136df849aba2dc67dbebe8054b445742bd4760eb2d9b0c79ab073b
UnsafeLoadSpringResource.java https://github.com/github/codeql/pull/9199/files#diff-cf83104064664b3a1ee5f1b27d2d16e1c8f4316377aaaa68c5dba964e0823433
UnsafeUrlForward.expected https://github.com/github/codeql/pull/9199/files#diff-cee29b69dfd9b0b1243fd0589f66ac94dfd0c3b43cd5de6892331df28db85f95
options https://github.com/github/codeql/pull/9199/files#diff-a23d6723ceb9ac152050ee8f7d948a8b29e6f3b36a0143e4f85a7272e62e5d0c
ClassPathResource.java https://github.com/github/codeql/pull/9199/files#diff-dfbe366c1655f3701b82fd68dbb2e31a8feddf9f5d01673e43178a9a002d4bdf
ResourceLoader.java https://github.com/github/codeql/pull/9199/files#diff-0c189fd49e61e6b3d1c923c606a30c067a821572a98c2f9e29fc7c2a8f80f1f6
https://github.com/github/codeql/blob/main/CODEOWNERS#L16
java/ql/src/experimental/Security/CWE/CWE-552/UnsafeLoadSpringResource.javahttps://github.com/github/codeql/pull/9199/files#diff-0e56fadcb29ab30b8b9a36beaad4289e301d09577007be05b125446192c5ba01
View file https://github.com/luchua-bc/ql/blob/7ff82bbed35282d8040b8bf5db9d0225f866b059/java/ql/src/experimental/Security/CWE/CWE-552/UnsafeLoadSpringResource.java
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/9199/{{ revealButtonHref }}
https://github.com/github/codeql/blob/main/CODEOWNERS#L16
java/ql/src/experimental/Security/CWE/CWE-552/UnsafeUrlForward.qhelphttps://github.com/github/codeql/pull/9199/files#diff-3e5cfcc60b5abc0126d377789c00f2606f31d2cb303c412acca9c927e0a0d722
View file https://github.com/luchua-bc/ql/blob/7ff82bbed35282d8040b8bf5db9d0225f866b059/java/ql/src/experimental/Security/CWE/CWE-552/UnsafeUrlForward.qhelp
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/9199/{{ revealButtonHref }}
https://github.com/github/codeql/pull/9199/files#diff-3e5cfcc60b5abc0126d377789c00f2606f31d2cb303c412acca9c927e0a0d722
https://github.com/github/codeql/pull/9199/files#diff-3e5cfcc60b5abc0126d377789c00f2606f31d2cb303c412acca9c927e0a0d722
https://github.com/github/codeql/blob/main/CODEOWNERS#L16
java/ql/src/experimental/Security/CWE/CWE-552/UnsafeUrlForward.qlhttps://github.com/github/codeql/pull/9199/files#diff-3caec98bb63246165cd000f9dbbac654f2cd460af72d62cc2b6c0001f62eaf5e
View file https://github.com/luchua-bc/ql/blob/7ff82bbed35282d8040b8bf5db9d0225f866b059/java/ql/src/experimental/Security/CWE/CWE-552/UnsafeUrlForward.ql
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/9199/{{ revealButtonHref }}
https://github.com/github/codeql/pull/9199/files#diff-3caec98bb63246165cd000f9dbbac654f2cd460af72d62cc2b6c0001f62eaf5e
https://github.com/github/codeql/blob/main/CODEOWNERS#L16
java/ql/src/experimental/Security/CWE/CWE-552/UnsafeUrlForward.qllhttps://github.com/github/codeql/pull/9199/files#diff-171b613f67732add15b5c1b18e1c983ed4522338e7debe776016bcd4f13ffcba
View file https://github.com/luchua-bc/ql/blob/7ff82bbed35282d8040b8bf5db9d0225f866b059/java/ql/src/experimental/Security/CWE/CWE-552/UnsafeUrlForward.qll
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/9199/{{ revealButtonHref }}
https://github.com/github/codeql/pull/9199/files#diff-171b613f67732add15b5c1b18e1c983ed4522338e7debe776016bcd4f13ffcba
https://github.com/github/codeql/pull/9199/files#diff-171b613f67732add15b5c1b18e1c983ed4522338e7debe776016bcd4f13ffcba
https://github.com/github/codeql/pull/9199/files#diff-171b613f67732add15b5c1b18e1c983ed4522338e7debe776016bcd4f13ffcba
https://github.com/github/codeql/pull/9199/files#diff-171b613f67732add15b5c1b18e1c983ed4522338e7debe776016bcd4f13ffcba
https://github.com/github/codeql/pull/9199/files#diff-171b613f67732add15b5c1b18e1c983ed4522338e7debe776016bcd4f13ffcba
https://github.com/github/codeql/pull/9199/files#diff-171b613f67732add15b5c1b18e1c983ed4522338e7debe776016bcd4f13ffcba
https://github.com/github/codeql/blob/main/CODEOWNERS#L16
java/ql/src/experimental/semmle/code/java/frameworks/SpringResource.qllhttps://github.com/github/codeql/pull/9199/files#diff-68b35a808b136df849aba2dc67dbebe8054b445742bd4760eb2d9b0c79ab073b
View file https://github.com/luchua-bc/ql/blob/7ff82bbed35282d8040b8bf5db9d0225f866b059/java/ql/src/experimental/semmle/code/java/frameworks/SpringResource.qll
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/9199/{{ revealButtonHref }}
https://github.com/github/codeql/blob/main/CODEOWNERS#L16
java/ql/test/experimental/query-tests/security/CWE-552/UnsafeLoadSpringResource.javahttps://github.com/github/codeql/pull/9199/files#diff-cf83104064664b3a1ee5f1b27d2d16e1c8f4316377aaaa68c5dba964e0823433
View file https://github.com/luchua-bc/ql/blob/7ff82bbed35282d8040b8bf5db9d0225f866b059/java/ql/test/experimental/query-tests/security/CWE-552/UnsafeLoadSpringResource.java
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/9199/{{ revealButtonHref }}
https://github.com/github/codeql/blob/main/CODEOWNERS#L16
java/ql/test/experimental/query-tests/security/CWE-552/UnsafeUrlForward.expectedhttps://github.com/github/codeql/pull/9199/files#diff-cee29b69dfd9b0b1243fd0589f66ac94dfd0c3b43cd5de6892331df28db85f95
View file https://github.com/luchua-bc/ql/blob/7ff82bbed35282d8040b8bf5db9d0225f866b059/java/ql/test/experimental/query-tests/security/CWE-552/UnsafeUrlForward.expected
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/9199/{{ revealButtonHref }}
https://github.com/github/codeql/pull/9199/files#diff-cee29b69dfd9b0b1243fd0589f66ac94dfd0c3b43cd5de6892331df28db85f95
https://github.com/github/codeql/pull/9199/files#diff-cee29b69dfd9b0b1243fd0589f66ac94dfd0c3b43cd5de6892331df28db85f95
https://github.com/github/codeql/pull/9199/files#diff-cee29b69dfd9b0b1243fd0589f66ac94dfd0c3b43cd5de6892331df28db85f95
https://github.com/github/codeql/pull/9199/files#diff-cee29b69dfd9b0b1243fd0589f66ac94dfd0c3b43cd5de6892331df28db85f95
https://github.com/github/codeql/pull/9199/files#diff-cee29b69dfd9b0b1243fd0589f66ac94dfd0c3b43cd5de6892331df28db85f95
https://github.com/github/codeql/blob/main/CODEOWNERS#L16
java/ql/test/experimental/query-tests/security/CWE-552/optionshttps://github.com/github/codeql/pull/9199/files#diff-a23d6723ceb9ac152050ee8f7d948a8b29e6f3b36a0143e4f85a7272e62e5d0c
View file https://github.com/luchua-bc/ql/blob/7ff82bbed35282d8040b8bf5db9d0225f866b059/java/ql/test/experimental/query-tests/security/CWE-552/options
Open in desktop https://desktop.github.com
https://github.co/hiddenchars
https://github.com/github/codeql/pull/9199/{{ revealButtonHref }}
https://github.com/github/codeql/blob/main/CODEOWNERS#L16
java/ql/test/stubs/springframework-5.3.8/org/springframework/core/io/ClassPathResource.javahttps://github.com/github/codeql/pull/9199/files#diff-dfbe366c1655f3701b82fd68dbb2e31a8feddf9f5d01673e43178a9a002d4bdf
View file https://github.com/luchua-bc/ql/blob/7ff82bbed35282d8040b8bf5db9d0225f866b059/java/ql/test/stubs/springframework-5.3.8/org/springframework/core/io/ClassPathResource.java
Open in desktop https://desktop.github.com
how customized files appear on GitHubhttps://docs.github.com/github/administering-a-repository/customizing-how-changed-files-appear-on-github
Please reload this pagehttps://github.com/github/codeql/pull/9199/files
https://github.com/github/codeql/blob/main/CODEOWNERS#L16
java/ql/test/stubs/springframework-5.3.8/org/springframework/core/io/ResourceLoader.javahttps://github.com/github/codeql/pull/9199/files#diff-0c189fd49e61e6b3d1c923c606a30c067a821572a98c2f9e29fc7c2a8f80f1f6
View file https://github.com/luchua-bc/ql/blob/7ff82bbed35282d8040b8bf5db9d0225f866b059/java/ql/test/stubs/springframework-5.3.8/org/springframework/core/io/ResourceLoader.java
Open in desktop https://desktop.github.com
how customized files appear on GitHubhttps://docs.github.com/github/administering-a-repository/customizing-how-changed-files-appear-on-github
Please reload this pagehttps://github.com/github/codeql/pull/9199/files
https://github.com
Termshttps://docs.github.com/site-policy/github-terms/github-terms-of-service
Privacyhttps://docs.github.com/site-policy/privacy-policies/github-privacy-statement
Securityhttps://github.com/security
Statushttps://www.githubstatus.com/
Communityhttps://github.community/
Docshttps://docs.github.com/
Contacthttps://support.github.com?tags=dotcom-footer

Viewport: width=device-width


URLs of crawlers that visited me.