René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"[Java] CWE-552: Query to detect configuration file/source code exposure from unsafe request dispatcher","articleBody":"## Query\r\n\r\n*Link to pull request with your CodeQL query:*\r\n\r\nRelevant PR: https://github.com/github/codeql/pull/6251\r\n\r\n## CVE ID(s)\r\n\r\n*List the CVE ID(s) associated with this vulnerability. GitHub will automatically link CVE IDs to the [GitHub Advisory Database](https://github.com/advisories).*\r\n\r\n## Report\r\n\r\n*Describe the vulnerability. Provide any information you think will help GitHub assess the impact your query has on the open source community.*\r\n\r\nDirectly incorporating user input into HTTP requests dispatched from the Java EE \u003ccode\u003eRequestDispatcher\u003c/code\u003e without validating the input can allow any web application resource such as configuration files and source code to be disclosed.\r\n\r\nAs stated in the [Java API doc](https://jakarta.ee/specifications/webprofile/9/apidocs/jakarta/servlet/servletrequest#getRequestDispatcher-java.lang.String-), when using a Java EE \u003ccode\u003eRequestDispatcher\u003c/code\u003e, requests may be dispatched to any part of the web application bypassing both implicit (no direct access to WEB-INF or META-INF) and explicit (defined by the web application) security constraints. Unsanitized user provided data must not be used to construct the path passed to the \u003ccode\u003eRequestDispatcher\u003c/code\u003e as it is very likely to create a security vulnerability in the application.\r\n\r\nThis query detects unsafe invocations of RequestDispatcher with user controlled input.\r\n\r\n- [x] Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc). *We would love to have you spread the word about the good work you are doing*\r\n\r\n## Result(s)\r\n\r\n*Provide at least one useful result found by your query, on some revision of a real project.*\r\n\r\n- [softways-sa/swift-framework](https://github.com/softways-sa/swift-framework/)\r\n- [Online Drug Store](https://github.com/shashankpangam/OnlineDrugStore)\r\n","author":{"url":"https://github.com/luchua-bc","@type":"Person","name":"luchua-bc"},"datePublished":"2021-07-11T20:59:54.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":6},"url":"https://github.com/398/securitylab/issues/398"}