Repository navigation
Java: queries about user-controlled URLs should be sanitized by enforcing a prefix #4530
Description
This comes from a discussion with @smowton over here.
Certain categories such as Open Redirect, SSRF and Android WebView URL injection will benefit from a sanitizer which would clean the taint in case the dataflow goes through a string prefix operation (concatenation, format strings, string buffers, string writer ...). Since not controlling the begging of the URL will severely decrease the exploitability of these issues.
Activity
[-]General issue[/-][+]Java: queries about user-controlled URLs should be sanitized by enforcing a prefix[/+]smowton commentedon Oct 21, 2020
Added a descriptive title
smowton commentedon Oct 21, 2020
Looks like as well as the XSS query's clause relating to user-controlled fetches, this should also apply to other URL-based queries like
java/unvalidated-url-redirection. Go's version of the same query already filters in this way here: https://github.com/github/codeql-go/blob/main/ql/src/semmle/go/security/UrlConcatenation.qll#L94github-actions commentedon Apr 16, 2021
This issue is stale because it has been open 14 days with no activity. Comment or remove the
stalelabel in order to avoid having this issue closed in 7 days.neverlovelynn commentedon Apr 16, 2021
I encountered the same problem when using codeql. Is this problem solved now?
smowton commentedon Apr 16, 2021
Hah, I'd forgotten about this. I ported this from Go when promoting the Java SSRF query from experimental (#5587). That should be generalised to other queries concerned with a user-controlled URL.
ZH3FENG commentedon May 20, 2021
Same as javascript, so many false-positive reports, particularly SSRF.
Is there any filter in js?
pwntester commentedon Feb 23, 2022
Another category that would benefit from this is JNDI injections where attackers need to control the beginning of the url /cc @atorralba