CVE-2016-9878

app("SPRING"):
    requires(version: "ARMR/2.6")

    /***************************************************************************
        CVE-2016-9878 (SPRING)

        CVSS 3.0 Summary:
            Base Score              | 7.5
            Attack Vector           | Network
            Attack Complexity       | Low
            Privileges Required     | None
            User Interaction        | None
            Scope                   | Unchanged
            Confidentiality Impact  | High
            Integrity Impact        | None
            Availability Impact     | None

        Description:
            It was discovered that paths provided to the ResourceServlet were not
            properly sanitized and as a result exposed to directory traversal
            attacks.

        Resources:
            https://github.com/spring-projects/spring-framework/pull/1299/commits/e2d6e709c3c65a4951eb096843ee75d5200cfcad

        Affected Operating Systems:
            Any

        Affected Versions:
            Spring Framework: 3.2.17, 4.2.8, 4.3.4

        Tested Versions:
            4.3.4

        Protection Provided:
            Functional

        Patch Version:
            1.0
    ***************************************************************************/

    patch("CVE-2016-9878 :01"):
        function("org/springframework/web/servlet/ResourceServlet.doInclude(Ljavax/servlet/http/HttpServletRequest;Ljavax/servlet/http/HttpServletResponse;Ljava/lang/String;)V",
                 checksums: ["314cc3d0bf"]) // 4.3.4
        callreturn("org/springframework/util/StringUtils.tokenizeToStringArray(Ljava/lang/String;Ljava/lang/String;)[Ljava/lang/String;")

        code(language: java,   import: ["org.springframework.util.StringUtils"]):
            public void patch(JavaFrame frame) {
                String[] resourceUrls = (String[]) frame.loadObjectOperand(0);
                String[] cleanResourceUrls = new String[resourceUrls.length];

                for (int i = 0; i < resourceUrls.length; i++) {
                    String cleanedUrl = StringUtils.cleanPath(resourceUrls[i]);
                    cleanResourceUrls[i] = cleanedUrl;
                }
                frame.storeObjectOperand(0, cleanResourceUrls);
            }
        endcode
    endpatch

endapp