René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"[Java]: CWE-552 - Query to detect unsafe resource loading in Java Spring applications ","articleBody":"### Query PR\r\n\r\nhttps://github.com/github/codeql/pull/9199\r\n\r\n### Language\r\n\r\nJava\r\n\r\n### CVE(s) ID list\r\n\r\n- [CVE-2019-3799](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3799)\r\n\r\n### CWE\r\n\r\nCWE-552: Files or Directories Accessible to External Parties\r\n\r\n### Report\r\n\r\n1. What is the vulnerability?\r\nDirectly incorporating user input into loading resource calls on the server side without proper validation of the input can allow any web application resource such as configuration files and source code to be disclosed.\r\n\r\n2. How does the vulnerability work?\r\nt is very common that Java Spring applications load requested resources and return file contents to clients. Constructing a server-side URI path with user input could allow an attacker to download application binaries (including application classes or jar files) or view arbitrary files within protected directories.\r\n\r\n3. What strategy do you use in your query to find the vulnerability?\r\nThis query detects unsafe usage of resource loading in Spring including the following APIs:\r\n  - ClassPathResource\r\n  - ResourceUtils\r\n  - ResourceLoader and ApplicationContext\r\n\r\n4. How have you reduced the number of false positives?\r\nIt utilizes the path sanitizer library to reduce FPs:\r\n  - Path traversal check\r\n  - Path encoding check\r\n  - Check of path normalization using the java.nio.file.Path package\r\n\r\n5. Other information?\r\nPlease refer to test cases in the sample program and [CVE-2019-3799 - Spring-Cloud-Config-Server Directory Traversal \u0026lt; 2.1.2, 2.0.4, 1.4.6](https://github.com/mpgn/CVE-2019-3799) for more information.\r\n\r\n### Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc).\r\n\r\n- [X] Yes\r\n- [ ] No\r\n\r\n### Blog post link\r\n\r\n_No response_","author":{"url":"https://github.com/luchua-bc","@type":"Person","name":"luchua-bc"},"datePublished":"2022-05-17T19:18:29.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":12},"url":"https://github.com/675/securitylab/issues/675"}