René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"[Java] CWE-552: Unsafe url forward","articleBody":"## Query\r\n\r\n*Link to pull request with your CodeQL query:*\r\n\r\nRelevant PR: https://github.com/github/codeql/pull/6240\r\n\r\n## CVE ID(s)\r\n\r\n*List the CVE ID(s) associated with this vulnerability. GitHub will automatically link CVE IDs to the [GitHub Advisory Database](https://github.com/advisories).*\r\n\r\n- CVE-20nn-nnnnn\r\n\r\n## Report\r\n\r\nConstructing a server-side redirect path with user input could allow an attacker to download application binaries \r\n(including application classes or jar files) or view arbitrary files within protected directories.\r\n\r\n- [X] Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc). *We would love to have you spread the word about the good work you are doing*\r\n\r\nFYI I just wrote a blog [post](https://github.com/haby0/mark/blob/master/articles/2021/Detecting%20Request%20forwarde%20vulnerabilities%20with%20CodeQL.md) about the query and timing attacks.\r\n\r\n## Result(s)\r\n\r\n*Provide at least one useful result found by your query, on some revision of a real project.*\r\n\r\n- [eclipse/jetty.project](https://github.com/eclipse/jetty.project/blob/jetty-10.0.x/jetty-servlet/src/test/java/org/eclipse/jetty/servlet/DispatcherTest.java#L579) : test data\r\n\r\n- [caelum/vraptor4](https://github.com/caelum/vraptor4/blob/master/vraptor-core/src/main/java/br/com/caelum/vraptor/view/DefaultPageResult.java#L122) : [lgtm result](https://lgtm.com/query/6009295495026660913/)","author":{"url":"https://github.com/haby0","@type":"Person","name":"haby0"},"datePublished":"2021-07-12T05:08:52.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":12},"url":"https://github.com/399/securitylab/issues/399"}