Add File Disclosure Injection detector

[plr0man]

Proposed detector reports code utilizing ActionForward (Struts) or ModelAndView (Spring) to construct a server-side redirect path with user input. This may allow an attacker to view sensitive files or download application binaries.
Vulnerable code sample:

... 
String returnURL = request.getParameter("returnURL");
return new ModelAndView(returnURL); 

or

... 
String returnURL = request.getParameter("returnURL"); 
Return new ActionForward(returnURL);

[ptamarit]

I think that the following Spring snippet does the same risky redirects (returning a String instead of a ModelAndView:

@GetMapping
public String index(...) {
    // ...
    return "redirect:" + request.getParameter("returnURL");
}

See:

• https://docs.spring.io/spring/docs/current/spring-framework-reference/html/mvc.html#mvc-redirecting-redirect-prefix
• http://stackoverflow.com/questions/19516719/difference-between-redirect-and-redirect-inside-modelandview

I'm afraid that writing a detector for this case would be trickier though...

[plr0man]

Nice one Pablo! We'll have to pave the way for more of those. Do you want to add it to Issues so we don't loose it?

[ptamarit]

@plr0man: Done, I created #269.

[php-coder]

For example, requesting "http://example.com/?returnURL=WEB-INF/applicationContext.xml" would display the application's applicationContext.xml file.

I believe that this example is wrong and user will always get 404 or 500 error. To do a server-side redirect you need:

1. use forward method that isn't used by default. Hence, the parameter value should start from forward:
2. to get something in the WEB-INF dir, you need to add a slash to the beginning and only then this will be interpreted as a classpath resource.
3. now it still won't work because this string is passed to ViewResolver that most of the time configured to search in some directory and files that have particular suffix. Most likely you will be able to get JSP/HTML files only.
4. even if ViewResolver is configured to serve XML files, in modern Spring web apps (for example, Spring Boot) applicationContext.xml is absent at all because all the configuration is done in java classes