Skip to content

Introduced protections against user-controlled internal request forwarding #15

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Conversation

pixeebot[bot]
Copy link

@pixeebot pixeebot bot commented Jun 12, 2025

This change hardens all ServletRequest#getRequestDispatcher(String) calls against attack.

There is a built-in HTTP method for sending clients to another resource: the client-side redirect. However, the getRequestDispatcher(String) method is unique in that performs a forward which occurs totally within the server-side.

There is some security that usually comes within redirecting users back through the "front door". For instance, attackers could never directly request sensitive resources like /WEB-INF/web.xml. However, this isn't true for request dispatcher forwarding. Therefore, we must take special care that the path being forwarded isn't towards any known sensitive data.

Our change introduces an API that offers some validation against forwards that target sensitive data or attempt to access application code.

+ import static io.github.pixee.security.jakarta.PathValidator.validateDispatcherPath;
  ...
+ validateDispatcherPath(path);
  request.getRequestDispatcher(path).forward(request, response);
More reading

🧚🤖 Powered by Pixeebot

Feedback | Community | Docs | Codemod ID: pixee:java/validate-jakarta-forward-path

@@ -345,6 +345,10 @@
<artifactId>mockito-core</artifactId>
<scope>test</scope>
</dependency>
<dependency>
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This library holds security tools for protecting Java API calls.

License: MIT ✅ | Open source ✅ | More facts

@@ -23,4 +23,16 @@
<module>plugins</module>
<module>dist</module>
</modules>
<dependencyManagement>
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This library holds security tools for protecting Java API calls.

License: MIT ✅ | Open source ✅ | More facts

Copy link
Author

pixeebot bot commented Jun 20, 2025

I'm confident in this change, but I'm not a maintainer of this project. Do you see any reason not to merge it?

If this change was not helpful, or you have suggestions for improvements, please let me know!

Copy link
Author

pixeebot bot commented Jun 21, 2025

Forwarding is a dangerous by nature, and this API helps -- but some access to protected resources may be intended, so the control can't be very aggressive.

I think you should merge this protection to address some obvious risks and prevent exploitation by automated tools which can only target common and predictable targets. However, long term, I think you should consider an alternative architecture which doesn't rely on forwarding.

If there are other concerns about this change, I'd love to hear about them!

Copy link
Author

pixeebot bot commented Jun 27, 2025

This change may not be a priority right now, so I'll close it. If there was something I could have done better, please let me know!

You can also customize me to make sure I'm working with you in the way you want.

@pixeebot pixeebot bot closed this Jun 27, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants