Skip to content

Commit 29a9a76

Browse files
ex0dus-0xex0dus-0x
committed
Add docs and fix CI/CD issue
1 parent 3275b0d commit 29a9a76

File tree

4 files changed

+189
-1
lines changed

4 files changed

+189
-1
lines changed

‎README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,7 @@ codeql database analyze database.db --format=sarif-latest --output=./tob.sarif -
4848
|[Async unsafe signal handler](./cpp/src/docs/security/AsyncUnsafeSignalHandler/AsyncUnsafeSignalHandler.md)|Async unsafe signal handler (like the one used in CVE-2024-6387)|warning|high|
4949
|[Invalid string size passed to string manipulation function](./cpp/src/docs/security/CStrnFinder/CStrnFinder.md)|Finds calls to functions that take as input a string and its size as separate arguments (e.g., `strncmp`, `strncat`, ...) and the size argument is wrong|error|low|
5050
|[Missing null terminator](./cpp/src/docs/security/NoNullTerminator/NoNullTerminator.md)|This query finds incorrectly initialized strings that are passed to functions expecting null-byte-terminated strings|error|high|
51+
|[Potentially unguarded protocol handler invocation](./cpp/src/docs/security/PotentiallyUnguardedProtocolHandler/PotentiallyUnguardedProtocolHandler.md)|Detects calls to URL protocol handlers with untrusted input that may not be properly validated for dangerous protocols|warning|medium|
5152
|[Unsafe implicit integer conversion](./cpp/src/docs/security/UnsafeImplicitConversions/UnsafeImplicitConversions.md)|Finds implicit integer casts that may overflow or be truncated, with false positive reduction via Value Range Analysis|warning|low|
5253

5354
### Go
@@ -72,6 +73,7 @@ codeql database analyze database.db --format=sarif-latest --output=./tob.sarif -
7273

7374
| Name | Description | Severity | Precision |
7475
| --- | ----------- | :----: | :--------: |
76+
|[Potentially unguarded protocol handler invocation](./java/src/docs/security/PotentiallyUnguardedProtocolHandler/PotentiallyUnguardedProtocolHandler.md)|Detects calls to URL protocol handlers with untrusted input that may not be properly validated for dangerous protocols|warning|medium|
7577
|[Recursive functions](./java-kotlin/src/docs/security/Recursion/Recursion.md)|Detects recursive calls|warning|low|
7678

7779
## Query suites

‎cpp/src/docs/security/PotentiallyUnguardedProtocolHandler/PotentiallyUnguardedProtocolHandler.md‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
# Potentially unguarded protocol handler invocation
2+
3+
This query detects calls to URL protocol handlers with untrusted input that may not be properly validated for dangerous protocols. This vulnerability is related to CWE-939 (Improper Authorization in Handler for Custom URL Scheme) and aligns with CVE-2022-43550.
4+
5+
When applications invoke protocol handlers (like `rundll32 url.dll,FileProtocolHandler` on Windows, `xdg-open` on Linux, `open` on macOS, or Qt's `QDesktopServices::openUrl()`), untrusted URLs can potentially trigger dangerous protocols such as `file://`, `smb://`, or other custom handlers that may lead to unauthorized file access, command execution, or other security issues.
6+
7+
## Detected patterns
8+
9+
The query identifies several common protocol handler invocation patterns:
10+
11+
- **Windows**: `rundll32 url.dll,FileProtocolHandler` via system calls
12+
- **Linux**: `xdg-open` via system calls
13+
- **macOS**: `open` command via system calls
14+
- **Qt applications**: `QDesktopServices::openUrl()`
15+
16+
## Recommendation
17+
18+
Always validate URL schemes before passing them to protocol handlers. Only allow safe protocols like `http://` and `https://`. Reject or sanitize URLs containing potentially dangerous protocols.
19+
20+
## Example
21+
22+
The following vulnerable code passes untrusted input directly to a protocol handler:
23+
24+
```cpp
25+
#include <QDesktopServices>
26+
#include <QUrl>
27+
28+
void openUserUrl(const QString& userInput) {
29+
// VULNERABLE: No validation of the URL scheme
30+
QDesktopServices::openUrl(QUrl(userInput));
31+
}
32+
```
33+
34+
An attacker could provide a URL like `file:///etc/passwd` or `smb://attacker-server/share` to access unauthorized resources.
35+
36+
The corrected version validates the URL scheme before opening:
37+
38+
```cpp
39+
#include <QDesktopServices>
40+
#include <QUrl>
41+
42+
void openUserUrl(const QString& userInput) {
43+
QUrl url(userInput);
44+
QString scheme = url.scheme().toLower();
45+
46+
// Only allow safe protocols
47+
if (scheme == "http" || scheme == "https") {
48+
QDesktopServices::openUrl(url);
49+
} else {
50+
// Log error or show warning to user
51+
qWarning() << "Rejected unsafe URL scheme:" << scheme;
52+
}
53+
}
54+
```
55+
56+
For system command invocations:
57+
58+
```cpp
59+
void openUserUrlViaShell(const char* userInput) {
60+
// VULNERABLE: Untrusted input passed to xdg-open
61+
char cmd[512];
62+
snprintf(cmd, sizeof(cmd), "xdg-open '%s'", userInput);
63+
system(cmd);
64+
}
65+
```
66+
67+
Should be corrected to validate the scheme:
68+
69+
```cpp
70+
bool isValidScheme(const char* url) {
71+
return (strncasecmp(url, "http://", 7) == 0 ||
72+
strncasecmp(url, "https://", 8) == 0);
73+
}
74+
75+
void openUserUrlViaShell(const char* userInput) {
76+
if (isValidScheme(userInput)) {
77+
char cmd[512];
78+
snprintf(cmd, sizeof(cmd), "xdg-open '%s'", userInput);
79+
system(cmd);
80+
}
81+
}
82+
```
83+
84+
## References
85+
86+
- [CWE-939: Improper Authorization in Handler for Custom URL Scheme](https://cwe.mitre.org/data/definitions/939.html)
87+
- [CVE-2022-43550: USB Creator has insufficiently protected credentials](https://ubuntu.com/security/CVE-2022-43550)

‎java/src/docs/security/PotentiallyUnguardedProtocolHandler/PotentiallyUnguardedProtocolHandler.md‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
# Potentially unguarded protocol handler invocation
2+
3+
This query detects calls to URL protocol handlers with untrusted input that may not be properly validated for dangerous protocols. This vulnerability is related to CWE-939 (Improper Authorization in Handler for Custom URL Scheme) and aligns with CVE-2022-43550.
4+
5+
When Java applications invoke protocol handlers (like `Desktop.browse()`, `Runtime.exec()` with `xdg-open`/`open`, or `rundll32 url.dll,FileProtocolHandler` on Windows), untrusted URLs can potentially trigger dangerous protocols such as `file://`, `smb://`, or other custom handlers that may lead to unauthorized file access, command execution, or other security issues.
6+
7+
## Detected patterns
8+
9+
The query identifies several common protocol handler invocation patterns:
10+
11+
- **Java AWT**: `Desktop.browse(URI)` - the platform-agnostic standard
12+
- **Windows**: `Runtime.exec()` with `rundll32 url.dll,FileProtocolHandler`
13+
- **Linux**: `Runtime.exec()` with `xdg-open`
14+
- **macOS**: `Runtime.exec()` with `open` command
15+
16+
## Recommendation
17+
18+
Always validate URL schemes before passing them to protocol handlers. Only allow safe protocols like `http://` and `https://`. Reject or sanitize URLs containing potentially dangerous protocols.
19+
20+
## Example
21+
22+
The following vulnerable code passes untrusted input directly to a protocol handler:
23+
24+
```java
25+
import java.awt.Desktop;
26+
import java.net.URI;
27+
28+
public class UrlOpener {
29+
public void openUserUrl(String userInput) throws Exception {
30+
// VULNERABLE: No validation of the URL scheme
31+
Desktop.getDesktop().browse(new URI(userInput));
32+
}
33+
}
34+
```
35+
36+
An attacker could provide a URL like `file:///etc/passwd` or `smb://attacker-server/share` to access unauthorized resources.
37+
38+
The corrected version validates the URL scheme before opening:
39+
40+
```java
41+
import java.awt.Desktop;
42+
import java.net.URI;
43+
44+
public class UrlOpener {
45+
public void openUserUrl(String userInput) throws Exception {
46+
URI uri = new URI(userInput);
47+
String scheme = uri.getScheme();
48+
49+
// Only allow safe protocols
50+
if ("http".equalsIgnoreCase(scheme) || "https".equalsIgnoreCase(scheme)) {
51+
Desktop.getDesktop().browse(uri);
52+
} else {
53+
throw new SecurityException("Rejected unsafe URL scheme: " + scheme);
54+
}
55+
}
56+
}
57+
```
58+
59+
For system command invocations:
60+
61+
```java
62+
public class UrlOpener {
63+
public void openUserUrlViaShell(String userInput) throws Exception {
64+
// VULNERABLE: Untrusted input passed to xdg-open
65+
Runtime.getRuntime().exec(new String[]{"xdg-open", userInput});
66+
}
67+
}
68+
```
69+
70+
Should be corrected to validate the scheme:
71+
72+
```java
73+
import java.net.URI;
74+
75+
public class UrlOpener {
76+
private boolean isValidScheme(String url) {
77+
try {
78+
URI uri = new URI(url);
79+
String scheme = uri.getScheme();
80+
return "http".equalsIgnoreCase(scheme) || "https".equalsIgnoreCase(scheme);
81+
} catch (Exception e) {
82+
return false;
83+
}
84+
}
85+
86+
public void openUserUrlViaShell(String userInput) throws Exception {
87+
if (isValidScheme(userInput)) {
88+
Runtime.getRuntime().exec(new String[]{"xdg-open", userInput});
89+
} else {
90+
throw new SecurityException("Invalid or unsafe URL scheme");
91+
}
92+
}
93+
}
94+
```
95+
96+
## References
97+
98+
- [CWE-939: Improper Authorization in Handler for Custom URL Scheme](https://cwe.mitre.org/data/definitions/939.html)
99+
- [CVE-2022-43550: USB Creator has insufficiently protected credentials](https://ubuntu.com/security/CVE-2022-43550)

‎java/test/query-tests/security/PotentiallyUnguardedProtocolHandler/PotentiallyUnguardedProtocolHandler.qlref‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
security/PotentiallyUnguardedProtocolhandler/PotentiallyUnguardedProtocolhandler.ql
1+
security/PotentiallyUnguardedProtocolHandler/PotentiallyUnguardedProtocolHandler.ql

0 commit comments

Comments
 (0)