René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"[Java] CWE-552: Query to detect unsafe request dispatcher usage","articleBody":"## Query\r\n\r\n*Link to pull request with your CodeQL query:*\r\n\r\nRelevant PR: https://github.com/github/codeql/pull/7286\r\n\r\n## CVE ID(s)\r\n\r\n*List the CVE ID(s) associated with this vulnerability. GitHub will automatically link CVE IDs to the [GitHub Advisory Database](https://github.com/advisories).*\r\n\r\n- [CVE-2021-28169](https://github.com/eclipse/jetty.project/security/advisories/GHSA-gwcr-j4wh-j3cq)\r\n\r\n## Report\r\n\r\n*Describe the vulnerability. Provide any information you think will help GitHub assess the impact your query has on the open source community.*\r\n\r\nDirectly incorporating user input into HTTP requests dispatched from the Java EE RequestDispatcher without proper validation of the input can allow any web application resource such as configuration files and source code to be disclosed.\r\n\r\nAs stated in the [Java API doc](https://jakarta.ee/specifications/webprofile/9/apidocs/jakarta/servlet/servletrequest#getRequestDispatcher-java.lang.String-), when using a Java EE RequestDispatcher, requests may be dispatched to any part of the web application bypassing both implicit (no direct access to WEB-INF or META-INF) and explicit (defined by the web application) security constraints. Unsanitized user provided data must not be used to construct the path passed to the RequestDispatcher as it is very likely to create a security vulnerability in the application.\r\n\r\nThis query detects unsafe invocations of RequestDispatcher with user controlled input. Important features include:\r\n+ RequestDispatcher constructed from both HTTP request and servlet context\r\n+ Path traversal check\r\n+ Path encoding check\r\n+ Check of path normalization using the `java.nio.file.Path` package\r\n\r\n- [x] Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc). *We would love to have you spread the word about the good work you are doing*\r\n\r\n## Result(s)\r\n\r\n*Provide at least one useful result found by your query, on some revision of a real project.*\r\n\r\n- [Jetty Utility Servlets ConcatServlet Double Decoding Information Disclosure Vulnerability](https://github.com/eclipse/jetty.project/security/advisories/GHSA-gwcr-j4wh-j3cq)\r\n- [softways-sa/swift-framework](https://github.com/softways-sa/swift-framework/)\r\n- [Online Drug Store](https://github.com/shashankpangam/OnlineDrugStore)\r\n","author":{"url":"https://github.com/luchua-bc","@type":"Person","name":"luchua-bc"},"datePublished":"2021-12-02T04:19:53.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":15},"url":"https://github.com/495/securitylab/issues/495"}