[JAVA] Partial Path Traversal Vuln Query #9742

smehta23 · 2022-06-28T21:34:18Z

[JAVA] Partial Path Traversal Vuln Query
Finish Partial Path Traversal Query
Add additional tests from real world query run

smowton · 2022-06-29T13:43:37Z

Could you clarify if you're making a bounty application for this or not?

JLLeitschuh · 2022-06-29T14:31:17Z

Hi! This is submitted by my intern. I'd like him to turn this into a bounty application, if possible 🙂

java/ql/src/Security/CWE/CWE-023/PartialPathTraversalGood.java

java/ql/src/Security/CWE/CWE-023/PartialPathTraversalBad.java

java/ql/src/Security/CWE/CWE-023/PartialPathTraversalGood.java

Co-authored-by: Jonathan Leitschuh <jonathan.leitschuh@gmail.com>

java/ql/src/Security/CWE/CWE-023/PartialPathTraversal.qhelp

Co-authored-by: Jonathan Leitschuh <jonathan.leitschuh@gmail.com>

jkcso · 2022-07-11T18:46:06Z

java/ql/src/Security/CWE/CWE-023/PartialPathTraversal.qhelp

+  "qhelp.dtd">
+<qhelp>
+<overview>
+<p>User supplied file paths can often pose security risks if a program does not correctly handle them. In particular, if a user 


I would change the position of "correctly" to become "does not handle them correctly"

jkcso · 2022-07-11T18:46:39Z

java/ql/src/Security/CWE/CWE-023/PartialPathTraversal.qhelp

+<qhelp>
+<overview>
+<p>User supplied file paths can often pose security risks if a program does not correctly handle them. In particular, if a user 
+is meant to access files under a certain directory but does not enters a path under that directory, they can gain access to 


There's a typo here, "does not *enter"

jkcso · 2022-07-11T18:47:13Z

java/ql/src/Security/CWE/CWE-023/PartialPathTraversal.qhelp

+<overview>
+<p>User supplied file paths can often pose security risks if a program does not correctly handle them. In particular, if a user 
+is meant to access files under a certain directory but does not enters a path under that directory, they can gain access to 
+(and potentially modify/delete) unexpected, possibly sensitive resources. </p>


unexpectedly

Should it then be "...they can unexpectedly gain access to (and potentially modify/delete) possibly sensitive resources"?
(I've currently phrased it that way, but let me know if you'd prefer something different!)

You can do both here, choice is yours :-)

…ility

java/ql/src/Security/CWE/CWE-023/PartialPathTraversal.qhelp

java/ql/src/Security/CWE/CWE-023/PartialPathTraversalFromRemote.qhelp

…e.qhelp Co-authored-by: Chris Smowton <smowton@github.com>

Co-authored-by: Chris Smowton <smowton@github.com>

A <p> at the top isn't allowed, and for some reason the inclusion is required to be a valid qhelp file.

smowton · 2022-08-10T09:41:12Z

I've pushed two commits that proved necessary to performance-evaluate this PR:

Inlined one of the qhelp includes, because the included doc is required to itself be a valid qhelp doc, but <p> can't occur at top level, only inside an <overview> or similar top-level section. We can look at generalising the lightly-used qhelp-inclusion feature, but for now just duplicating that one paragraph is the quickest way to get this working.
Dataflow-path queries need import DataFlow::PathGraph in order to emit the edges and nodes relations that drive the flow paths shown in the code-scanning and vscode user interface. codeql database interpret-results will fail unless the expected relations are present.

smowton · 2022-08-11T08:54:18Z

@github/docs-content-codeql highlighting @JLLeitschuh's request above to expedite docs review on this PR due to the author shortly finishing their internship.

smowton · 2022-08-11T08:56:57Z

Pushed one further commit to autoformat ql to hopefully get tests passing.

smowton · 2022-08-11T16:18:15Z

Performance eval completed with benign results; just need docs review now.

mchammer01 · 2022-08-12T16:26:30Z

Covering for the docs first responder here 👋🏻 - I added this PR to our board for review by the Docs team. Thanks for your patience 🙇🏻‍♀️ 😅

mchammer01 · 2022-08-15T08:43:59Z

Apologies, I am on my own for 2 weeks, and am very busy, but will review this now. Thank you for your patience 🙇🏻‍♀️

mchammer01

Apologies for the delay in reviewing this 😢
This LGTM 💖
I've made a few comments to bring the content in line with our content model.
Let me know if you have any questions 😃

java/ql/src/Security/CWE/CWE-023/PartialPathTraversal.ql

java/ql/src/Security/CWE/CWE-023/PartialPathTraversalFromRemote.ql

java/ql/src/Security/CWE/CWE-023/PartialPathTraversalRemainder.inc.qhelp

java/ql/src/Security/CWE/CWE-023/PartialPathTraversal.qhelp

java/ql/src/Security/CWE/CWE-023/PartialPathTraversalRemainder.inc.qhelp

java/ql/src/Security/CWE/CWE-023/PartialPathTraversalFromRemote.qhelp

java/ql/src/Security/CWE/CWE-023/PartialPathTraversalRemainder.inc.qhelp

Co-authored-by: mc <42146119+mchammer01@users.noreply.github.com>

smowton · 2022-08-15T11:58:38Z

@JLLeitschuh @smehta23 was there ever a bounty application for this?

JLLeitschuh · 2022-08-15T14:33:58Z

We will submit one as soon as we both get back from Vegas

smehta23 added 3 commits June 28, 2022 13:52

[JAVA] Partial Path Traversal Vuln Query

4c7d476

Finish Partial Path Traversal Query

7122f29

Add additional tests from real world query run

b5ca2c3

github-actions bot added documentation Java labels Jun 28, 2022

smehta23 added 3 commits June 29, 2022 17:31

Add documentation of the Partial Path Traversal vuln

955e614

Fix duplicate class header and better fix using toPath()

7ab8f02

Fix typo in .qhelp

1681407

JLLeitschuh reviewed Jul 1, 2022

View reviewed changes

java/ql/src/Security/CWE/CWE-023/PartialPathTraversalGood.java Outdated Show resolved Hide resolved

JLLeitschuh reviewed Jul 1, 2022

View reviewed changes

java/ql/src/Security/CWE/CWE-023/PartialPathTraversalBad.java Outdated Show resolved Hide resolved

JLLeitschuh reviewed Jul 1, 2022

View reviewed changes

java/ql/src/Security/CWE/CWE-023/PartialPathTraversalGood.java Outdated Show resolved Hide resolved

smehta23 and others added 2 commits July 1, 2022 10:39

Update java/ql/src/Security/CWE/CWE-023/PartialPathTraversalBad.java

c6f2f61

Co-authored-by: Jonathan Leitschuh <jonathan.leitschuh@gmail.com>

Update java/ql/src/Security/CWE/CWE-023/PartialPathTraversalGood.java

209a216

Co-authored-by: Jonathan Leitschuh <jonathan.leitschuh@gmail.com>

JLLeitschuh reviewed Jul 1, 2022

View reviewed changes

java/ql/src/Security/CWE/CWE-023/PartialPathTraversal.qhelp Outdated Show resolved Hide resolved

Add ESAPI reference

300a14c

JLLeitschuh reviewed Jul 1, 2022

View reviewed changes

java/ql/src/Security/CWE/CWE-023/PartialPathTraversal.qhelp Outdated Show resolved Hide resolved

smehta23 and others added 4 commits July 1, 2022 10:51

Add CVE number

1a41d4c

Update java/ql/src/Security/CWE/CWE-023/PartialPathTraversal.qhelp

48e16e5

Co-authored-by: Jonathan Leitschuh <jonathan.leitschuh@gmail.com>

Update java/ql/src/Security/CWE/CWE-023/PartialPathTraversal.qhelp

ebe48ec

Co-authored-by: Jonathan Leitschuh <jonathan.leitschuh@gmail.com>

Update java/ql/src/Security/CWE/CWE-023/PartialPathTraversalGood.java

391dd5b

Co-authored-by: Jonathan Leitschuh <jonathan.leitschuh@gmail.com>

smehta23 marked this pull request as ready for review July 1, 2022 15:25

smehta23 requested a review from a team as a code owner July 1, 2022 15:25

Change log

39f8854

jkcso reviewed Jul 11, 2022

View reviewed changes

smehta23 and others added 2 commits July 12, 2022 01:48

Merge branch 'main' into feat/SM/java_partial_path_traversal_vulnerab…

781a2a7

…ility

Incorporate jksco's feedback

65b9947

smowton reviewed Aug 9, 2022

View reviewed changes

smehta23 and others added 6 commits August 9, 2022 11:58

Update java/ql/src/Security/CWE/CWE-023/PartialPathTraversalFromRemot…

c2b670e

…e.qhelp Co-authored-by: Chris Smowton <smowton@github.com>

Update java/ql/src/Security/CWE/CWE-023/PartialPathTraversalFromRemot…

7da0740

…e.qhelp Co-authored-by: Chris Smowton <smowton@github.com>

Update java/ql/src/Security/CWE/CWE-023/PartialPathTraversal.qhelp

4d80fd0

Co-authored-by: Chris Smowton <smowton@github.com>

Update java/ql/src/Security/CWE/CWE-023/PartialPathTraversal.qhelp

cf68a11

Co-authored-by: Chris Smowton <smowton@github.com>

Inline qhelp overview

2ca0b0c

A <p> at the top isn't allowed, and for some reason the inclusion is required to be a valid qhelp file.

Add dataflow path-graph

09e4c6b

Autoformat ql

e9df675

mchammer01 self-requested a review August 15, 2022 08:39

mchammer01 previously approved these changes Aug 15, 2022

View reviewed changes

mchammer01 reviewed Aug 15, 2022

View reviewed changes

java/ql/src/Security/CWE/CWE-023/PartialPathTraversalFromRemote.qhelp Outdated Show resolved Hide resolved

mchammer01 reviewed Aug 15, 2022

View reviewed changes

java/ql/src/Security/CWE/CWE-023/PartialPathTraversalRemainder.inc.qhelp Outdated Show resolved Hide resolved

Apply docs suggestions

3cf871e

Co-authored-by: mc <42146119+mchammer01@users.noreply.github.com>

smowton dismissed mchammer01’s stale review via 3cf871e August 15, 2022 09:34

Style edit

5677e38

smowton previously approved these changes Aug 15, 2022

View reviewed changes

Remove extra closing tag

1a3dc1d

smowton dismissed their stale review via 1a3dc1d August 15, 2022 10:31

smowton approved these changes Aug 15, 2022

View reviewed changes

smowton merged commit 774e379 into github:main Aug 15, 2022

smehta23 mentioned this pull request Aug 16, 2022

[JAVA]: Partial Path Traversal github/securitylab#699

Closed

2 tasks

ataillefer mentioned this pull request Jan 16, 2023

Fix partial path traversal Java example #11899

Merged

[JAVA] Partial Path Traversal Vuln Query #9742

[JAVA] Partial Path Traversal Vuln Query #9742

Uh oh!

Conversation

smehta23 commented Jun 28, 2022

Uh oh!

smowton commented Jun 29, 2022

Uh oh!

JLLeitschuh commented Jun 29, 2022

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jkcso Jul 11, 2022

Choose a reason for hiding this comment

Uh oh!

jkcso Jul 11, 2022

Choose a reason for hiding this comment

Uh oh!

jkcso Jul 11, 2022

Choose a reason for hiding this comment

Uh oh!

smehta23 Jul 12, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jkcso Jul 12, 2022

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

smowton commented Aug 10, 2022

Uh oh!

smowton commented Aug 11, 2022

Uh oh!

smowton commented Aug 11, 2022

Uh oh!

smowton commented Aug 11, 2022

Uh oh!

mchammer01 commented Aug 12, 2022

Uh oh!

mchammer01 commented Aug 15, 2022

Uh oh!

mchammer01 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

smowton commented Aug 15, 2022

Uh oh!

JLLeitschuh commented Aug 15, 2022

Uh oh!

Uh oh!

smehta23 Jul 12, 2022 •

edited

Loading