feat(java): detect doCheck* file-capability probes without a permission check (CWE-200)

java/jenkins/info-disclosure/docheck-file-capability-probes.yaml

@@ -0,0 +1,52 @@
+rules:
+  - id: codevigilant.java.jenkins.info-disclosure.docheck-file-capability-probes
+    patterns:
+      - pattern-inside: |
+          public $RET $HANDLER(...) {
+            ...
+          }
+      - metavariable-regex:
+          metavariable: $HANDLER
+          regex: ^doCheck[A-Z]
+      - pattern-inside: |
+          $T $F = new File($V);
+          ...
+      - pattern-either:
+          - pattern: $F.canRead()
+          - pattern: $F.canWrite()
+          - pattern: $F.canExecute()
+          - pattern: $F.isFile()
+          - pattern: $F.isDirectory()
+          - pattern: $F.length()
+          - pattern: $F.listFiles()
+      - pattern-not-inside: |
+          public $RET $HANDLER(...) {
+            ...
+            $X.checkPermission($PERM);
+            ...
+          }
+    message: |
+      Detected a Stapler form-validation handler (doCheck*) that probes local
+      file capabilities (canRead/canWrite/canExecute/isFile/isDirectory/length)
+      on a path built from handler input ('new File($V)') without an explicit
+      ACL permission check. Descriptor doCheck* methods are routed directly by
+      Stapler and are not protected by any permission by default, so any user
+      who can reach the descriptor URL can use the endpoint as a
+      file-capability oracle for arbitrary paths on the Jenkins controller
+      (CWE-200). Guard the handler with an explicit permission check such as
+      Jenkins.get().checkPermission(Jenkins.ADMINISTER) before touching the
+      filesystem, or remove the probe.
+    metadata:
+      category: security
+      cwe: "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"
+      owasp: "A01:2021 - Broken Access Control"
+      technology: jenkins
+      confidence: MEDIUM
+      references:
+        - https://www.jenkins.io/doc/developer/security/
+        - https://www.jenkins.io/doc/developer/forms/validation/
+      source: independent security review
+      license: MIT
+    languages: [java]
+    mode: search
+    severity: HIGH

testcases/java/negative/CapabilityNeg.java

@@ -0,0 +1,18 @@
+import hudson.util.FormValidation;
+import java.io.File;
+
+public class CapabilityNeg {
+    public FormValidation doCheckPath(String value) {
+        Jenkins.get().checkPermission(Jenkins.ADMINISTER);
+        File ftmp = new File(value);
+        if (!ftmp.canRead())
+            return FormValidation.error("cannot read");
+        if (!ftmp.isFile())
+            return FormValidation.error("not a file");
+        return FormValidation.ok();
+    }
+
+    public FormValidation doCheckOther(String value) {
+        return FormValidation.ok();
+    }
+}

testcases/java/positive/CapabilityPos.java

@@ -0,0 +1,17 @@
+import hudson.util.FormValidation;
+import java.io.File;
+
+public class CapabilityPos {
+    public FormValidation doCheckDax_file(String value) {
+        File ftmp = new File(value);
+        if (!ftmp.exists())
+            return FormValidation.error("Specified file not found.");
+        if (!ftmp.canRead())
+            return FormValidation.error("Specified file cannot be read.");
+        if (!ftmp.isFile())
+            return FormValidation.error("Specified path is no file.");
+        if (!ftmp.canExecute())
+            return FormValidation.error("Specified file cannot be executed.");
+        return FormValidation.ok();
+    }
+}