From 16c79f063d78cce6b627760e7a85ee0c691cca3a Mon Sep 17 00:00:00 2001 From: ai-anant Date: Fri, 4 Sep 2026 00:23:29 +0530 Subject: [PATCH] feat(java): detect non-literal path segments appended to JAX-RS WebTarget (CWE-22) --- .../rest-api/path-segment-nonliteral.yaml | 30 +++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 java/jenkins/rest-api/path-segment-nonliteral.yaml diff --git a/java/jenkins/rest-api/path-segment-nonliteral.yaml b/java/jenkins/rest-api/path-segment-nonliteral.yaml new file mode 100644 index 0000000..4d40d08 --- /dev/null +++ b/java/jenkins/rest-api/path-segment-nonliteral.yaml @@ -0,0 +1,30 @@ +rules: + - id: codevigilant.java.jenkins.rest-api.path-segment-nonliteral + patterns: + - pattern-either: + - pattern: $TARGET.path($SEG) + - pattern: $TARGET.path($SEG + $REST) + - pattern-not: $TARGET.path("...") + message: | + Detected a JAX-RS/Jersey WebTarget path segment appended via .path() + from a non-literal expression. Unlike query parameters, path segments + are not fully encoded by .path() — values containing '/' or '..' change + which REST endpoint is requested. When the value derives from an + attacker-influenced field (job config, build parameter, request input), + the request can be steered to other endpoints of the same service while + carrying the stored session token (REST path manipulation, CWE-22). + Validate the segment against an allowlist (alphanumerics, '-', '_') or + use the service SDK's dedicated ID/path builders before appending. + metadata: + category: security + cwe: "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" + owasp: "A01:2021 - Broken Access Control" + technology: jenkins + confidence: MEDIUM + references: + - https://docs.oracle.com/javaee/7/api/javax/ws/rs/client/WebTarget.html + source: independent security review + license: MIT + languages: [java] + mode: search + severity: HIGH \ No newline at end of file