René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"[Java]: CWE-552 Add sources and sinks to detect unsafe getResource calls in Java EE applications","articleBody":"### Query PR\n\nhttps://github.com/github/codeql/pull/8706\n\n### Language\n\nJava\n\n### CVE(s) ID list\n\n- [CVE-2018-1047 - Path traversal vulnerability with Wildfly 9.x through ServletResourceManager.getResource](https://nvd.nist.gov/vuln/detail/CVE-2018-1047)\r\n- [CVE-2015-5174 - Apache Tomcat 6.0/7.0/8.0/9.0 Servletcontext Getresource/getresourceasstream/getresourcepaths Path Traversal](https://vuldb.com/?source_cve.81084)\n\n### CWE\n\nCWE-552: Files or Directories Accessible to External Parties\n\n### Report\n\n1. What is the vulnerability?\r\nDirectly incorporating user input into the getResource call on the server side without proper validation of the input can allow any web application resource such as configuration files and source code to be disclosed.\r\n\r\n2. How does the vulnerability work?\r\nIt is very common that Java EE applications load requested resources and return file contents to clients. Constructing a server-side URI path with user input could allow an attacker to download application binaries (including application classes or jar files) or view arbitrary files within protected directories.\r\n\r\n3. What strategy do you use in your query to find the vulnerability?\r\nThis query detects unsafe usage of `getResource` or `getResourceAsStream` from both servlet context and Java Server Faces context, which covers all typical Java EE applications.\r\n\r\n4. How have you reduced the number of **false positives**?\r\nIt utilizes the path sanitizer library to reduce FPs:\r\n- Path traversal check\r\n- Path encoding check\r\n- Check of path normalization using the java.nio.file.Path package\r\n\r\n5. Other information?\r\nPlease refer to test cases and the sample program for more information.\r\n\n\n### Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc).\n\n- [X] Yes\n- [ ] No\n\n### Blog post link\n\n_No response_","author":{"url":"https://github.com/luchua-bc","@type":"Person","name":"luchua-bc"},"datePublished":"2022-04-09T01:42:40.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":26},"url":"https://github.com/665/securitylab/issues/665"}