Java: CWE-625 Query to detect regex dot bypass

[luchua-bc]

By default, "dot" (.) in regular expressions matches all characters except newline characters \n and
\r. Regular expressions containing a dot can be bypassed with the characters \r(%0a) and \n(%0d) when the default regex matching implementations of Java are used. When regular expressions serve to match protected resource patterns to grant access to protected application resources, attackers can gain access to unauthorized paths.

This query helps to detect insecure patterns and guard against unauthorized access by checking two patterns:

• whether a safe regex pattern is used
• whether a safe Java API is in place

Please consider to merge this PR.

Thanks,
@luchua-bc

[atorralba]

Hey @luchua-bc, thanks for your contribution. I made some inline comments, and also pushed a commit to make SpringUrlRedirect.qll a shared library, since you're reusing it from another experimental query.

[luchua-bc]

Thank @atorralba a lot for reviewing this PR. I’m on a vacation trip now and will work on the changes early next week after I’m back.

Have a nice day!

@luchua-bc

[luchua-bc]

Thank @atorralba for the commit of shared library and the comments. I've made all the suggested changes.

Please review again when you have a chance.

Cheers,
@luchua-bc

[atorralba]

I added another comment.

Additionally, I tried to verify the Apache Shiro result with your query and it seems it's no longer working. Could you take a look?

[luchua-bc]

Thank @atorralba a lot for all your help with this PR.