Java: Add check for J2EE server directory listing

[luchua-bc]

Enabling directory listing in J2EE application servers introduces the vulnerability of filename and path disclosure, which could allow an attacker to read arbitrary files in the server web directory. This includes application source code and data, as well as credentials for back-end systems.

Directory listing can be enabled via web.xml configuration of J2EE application servers:

    <servlet>
        <servlet-name>default</servlet-name>
        <servlet-class>org.apache.catalina.servlets.DefaultServlet</servlet-class>
        <init-param>
            <param-name>listings</param-name>
            <param-value>true</param-value>
        </init-param>
    </servlet>

This PR adds a CodeQL query to find all insecure web.xml with the listing property set to true.

[luchua-bc]

Hi @aschackmull,

Somehow the check of "Code scanning - action / CodeQL-Build (pull_request)" still failed. The error message seems to indicate CodeQL tried to validate the query as C-Sharp code:

2020-06-23T14:35:00.5496700Z Languages from configuration: ["csharp"]
2020-06-23T14:35:00.8028829Z ##[error]The configuration file "/home/runner/work/codeql/codeql/.github/codeql/codeql-config.yml" does not exist
2020-06-23T14:35:00.9796202Z Post job cleanup.

I doubt this error is related to the previously missing ending newline character. How can this issue be fixed? Please advise.

Thanks,
@luchua-bc

[aschackmull]

The CodeQL scanning action is a fairly new addition and the failure is unrelated to this PR, so we can disregard it.

[luchua-bc]

Thanks @aschackmull a lot for all your help with this PR.

@luchua-bc