Add PotentiallyUnguardedProtocolHandler query for Java and C++ by ex0dus-0x · Pull Request #32 · trailofbits/codeql-queries

ex0dus-0x · 2025-12-17T15:52:30Z

This a multi-language query that attempts to model CVE-2022-43550 for desktop apps that employ protocol handling on untrusted URLs through a variety of mechanisms. If no sanitization/guards are introduced, then links with arbitrary protocols (eg. smb:// and some-custom-vuln-handler://) can be supplied to trigger unintended actions against a user that clicks.

Languages and frameworks supported:

C/C++
- Generic shell invoction through rundll32 url.dll,FileProtocolHandler, xdg-open and open for their respective platforms
- Qt's QDesktopServices::openUrl
Java
- Generic sell invocation
- Desktop.browse()

+
+ public void bad1(HttpServletRequest request) throws IOException, URISyntaxException {
+ String url = request.getParameter("url");
+ Desktop.getDesktop().browse(new URI(url));


+ String url = request.getParameter("url");
+ URI uri = new URI(url);
+ if (uri.getScheme().equals("https") || uri.getScheme().equals("http")) {
+ Desktop.getDesktop().browse(uri);


+
+ // Weak check - only checks if scheme exists, not what it is
+ if (uri.getScheme() != null) {
+ Desktop.getDesktop().browse(uri);


+ public void bad6_rundll32(HttpServletRequest request) throws IOException {
+ String url = request.getParameter("url");
+ // ProcessBuilder with list
+ ProcessBuilder pb = new ProcessBuilder("rundll32", "url.dll,FileProtocolHandler", url);


… platforms

ex0dus-0x · 2025-12-17T15:52:30Z

This a multi-language query that attempts to model CVE-2022-43550 for desktop apps that employ protocol handling on untrusted URLs through a variety of mechanisms. If no sanitization/guards are introduced, then links with arbitrary protocols (eg. smb:// and some-custom-vuln-handler://) can be supplied to trigger unintended actions against a user that clicks.

Languages and frameworks supported:

C/C++
- Generic shell invoction through rundll32 url.dll,FileProtocolHandler, xdg-open and open for their respective platforms
- Qt's QDesktopServices::openUrl
Java
- Generic sell invocation
- Desktop.browse()

+
+ public void bad1(HttpServletRequest request) throws IOException, URISyntaxException {
+ String url = request.getParameter("url");
+ Desktop.getDesktop().browse(new URI(url));


+ String url = request.getParameter("url");
+ URI uri = new URI(url);
+ if (uri.getScheme().equals("https") || uri.getScheme().equals("http")) {
+ Desktop.getDesktop().browse(uri);


+
+ // Weak check - only checks if scheme exists, not what it is
+ if (uri.getScheme() != null) {
+ Desktop.getDesktop().browse(uri);


+ public void bad6_rundll32(HttpServletRequest request) throws IOException {
+ String url = request.getParameter("url");
+ // ProcessBuilder with list
+ ProcessBuilder pb = new ProcessBuilder("rundll32", "url.dll,FileProtocolHandler", url);


… platforms

ex0dus-0x · 2025-12-17T15:52:30Z

This a multi-language query that attempts to model CVE-2022-43550 for desktop apps that employ protocol handling on untrusted URLs through a variety of mechanisms. If no sanitization/guards are introduced, then links with arbitrary protocols (eg. smb:// and some-custom-vuln-handler://) can be supplied to trigger unintended actions against a user that clicks.

Languages and frameworks supported:

C/C++
- Generic shell invoction through rundll32 url.dll,FileProtocolHandler, xdg-open and open for their respective platforms
- Qt's QDesktopServices::openUrl
Java
- Generic sell invocation
- Desktop.browse()

+
+ public void bad1(HttpServletRequest request) throws IOException, URISyntaxException {
+ String url = request.getParameter("url");
+ Desktop.getDesktop().browse(new URI(url));


+ String url = request.getParameter("url");
+ URI uri = new URI(url);
+ if (uri.getScheme().equals("https") || uri.getScheme().equals("http")) {
+ Desktop.getDesktop().browse(uri);


+
+ // Weak check - only checks if scheme exists, not what it is
+ if (uri.getScheme() != null) {
+ Desktop.getDesktop().browse(uri);


+ public void bad6_rundll32(HttpServletRequest request) throws IOException {
+ String url = request.getParameter("url");
+ // ProcessBuilder with list
+ ProcessBuilder pb = new ProcessBuilder("rundll32", "url.dll,FileProtocolHandler", url);


… platforms

ex0dus-0x · 2025-12-17T15:52:30Z

This a multi-language query that attempts to model CVE-2022-43550 for desktop apps that employ protocol handling on untrusted URLs through a variety of mechanisms. If no sanitization/guards are introduced, then links with arbitrary protocols (eg. smb:// and some-custom-vuln-handler://) can be supplied to trigger unintended actions against a user that clicks.

Languages and frameworks supported:

C/C++
- Generic shell invoction through rundll32 url.dll,FileProtocolHandler, xdg-open and open for their respective platforms
- Qt's QDesktopServices::openUrl
Java
- Generic sell invocation
- Desktop.browse()

+
+ public void bad1(HttpServletRequest request) throws IOException, URISyntaxException {
+ String url = request.getParameter("url");
+ Desktop.getDesktop().browse(new URI(url));


+ String url = request.getParameter("url");
+ URI uri = new URI(url);
+ if (uri.getScheme().equals("https") || uri.getScheme().equals("http")) {
+ Desktop.getDesktop().browse(uri);


+
+ // Weak check - only checks if scheme exists, not what it is
+ if (uri.getScheme() != null) {
+ Desktop.getDesktop().browse(uri);


+ public void bad6_rundll32(HttpServletRequest request) throws IOException {
+ String url = request.getParameter("url");
+ // ProcessBuilder with list
+ ProcessBuilder pb = new ProcessBuilder("rundll32", "url.dll,FileProtocolHandler", url);


… platforms

ex0dus-0x · 2025-12-17T15:52:30Z

This a multi-language query that attempts to model CVE-2022-43550 for desktop apps that employ protocol handling on untrusted URLs through a variety of mechanisms. If no sanitization/guards are introduced, then links with arbitrary protocols (eg. smb:// and some-custom-vuln-handler://) can be supplied to trigger unintended actions against a user that clicks.

Languages and frameworks supported:

C/C++
- Generic shell invoction through rundll32 url.dll,FileProtocolHandler, xdg-open and open for their respective platforms
- Qt's QDesktopServices::openUrl
Java
- Generic sell invocation
- Desktop.browse()

+
+ public void bad1(HttpServletRequest request) throws IOException, URISyntaxException {
+ String url = request.getParameter("url");
+ Desktop.getDesktop().browse(new URI(url));


+ String url = request.getParameter("url");
+ URI uri = new URI(url);
+ if (uri.getScheme().equals("https") || uri.getScheme().equals("http")) {
+ Desktop.getDesktop().browse(uri);


+
+ // Weak check - only checks if scheme exists, not what it is
+ if (uri.getScheme() != null) {
+ Desktop.getDesktop().browse(uri);


+ public void bad6_rundll32(HttpServletRequest request) throws IOException {
+ String url = request.getParameter("url");
+ // ProcessBuilder with list
+ ProcessBuilder pb = new ProcessBuilder("rundll32", "url.dll,FileProtocolHandler", url);


… platforms

ex0dus-0x · 2025-12-17T15:52:30Z

This a multi-language query that attempts to model CVE-2022-43550 for desktop apps that employ protocol handling on untrusted URLs through a variety of mechanisms. If no sanitization/guards are introduced, then links with arbitrary protocols (eg. smb:// and some-custom-vuln-handler://) can be supplied to trigger unintended actions against a user that clicks.

Languages and frameworks supported:

C/C++
- Generic shell invoction through rundll32 url.dll,FileProtocolHandler, xdg-open and open for their respective platforms
- Qt's QDesktopServices::openUrl
Java
- Generic sell invocation
- Desktop.browse()

+
+ public void bad1(HttpServletRequest request) throws IOException, URISyntaxException {
+ String url = request.getParameter("url");
+ Desktop.getDesktop().browse(new URI(url));


+ String url = request.getParameter("url");
+ URI uri = new URI(url);
+ if (uri.getScheme().equals("https") || uri.getScheme().equals("http")) {
+ Desktop.getDesktop().browse(uri);


+
+ // Weak check - only checks if scheme exists, not what it is
+ if (uri.getScheme() != null) {
+ Desktop.getDesktop().browse(uri);


+ public void bad6_rundll32(HttpServletRequest request) throws IOException {
+ String url = request.getParameter("url");
+ // ProcessBuilder with list
+ ProcessBuilder pb = new ProcessBuilder("rundll32", "url.dll,FileProtocolHandler", url);


… platforms

ex0dus-0x · 2025-12-17T15:52:30Z

This a multi-language query that attempts to model CVE-2022-43550 for desktop apps that employ protocol handling on untrusted URLs through a variety of mechanisms. If no sanitization/guards are introduced, then links with arbitrary protocols (eg. smb:// and some-custom-vuln-handler://) can be supplied to trigger unintended actions against a user that clicks.

Languages and frameworks supported:

C/C++
- Generic shell invoction through rundll32 url.dll,FileProtocolHandler, xdg-open and open for their respective platforms
- Qt's QDesktopServices::openUrl
Java
- Generic sell invocation
- Desktop.browse()

+
+ public void bad1(HttpServletRequest request) throws IOException, URISyntaxException {
+ String url = request.getParameter("url");
+ Desktop.getDesktop().browse(new URI(url));


+ String url = request.getParameter("url");
+ URI uri = new URI(url);
+ if (uri.getScheme().equals("https") || uri.getScheme().equals("http")) {
+ Desktop.getDesktop().browse(uri);


+
+ // Weak check - only checks if scheme exists, not what it is
+ if (uri.getScheme() != null) {
+ Desktop.getDesktop().browse(uri);


+ public void bad6_rundll32(HttpServletRequest request) throws IOException {
+ String url = request.getParameter("url");
+ // ProcessBuilder with list
+ ProcessBuilder pb = new ProcessBuilder("rundll32", "url.dll,FileProtocolHandler", url);


… platforms

ex0dus-0x · 2025-12-17T15:52:30Z

This a multi-language query that attempts to model CVE-2022-43550 for desktop apps that employ protocol handling on untrusted URLs through a variety of mechanisms. If no sanitization/guards are introduced, then links with arbitrary protocols (eg. smb:// and some-custom-vuln-handler://) can be supplied to trigger unintended actions against a user that clicks.

Languages and frameworks supported:

C/C++
- Generic shell invoction through rundll32 url.dll,FileProtocolHandler, xdg-open and open for their respective platforms
- Qt's QDesktopServices::openUrl
Java
- Generic sell invocation
- Desktop.browse()

+
+ public void bad1(HttpServletRequest request) throws IOException, URISyntaxException {
+ String url = request.getParameter("url");
+ Desktop.getDesktop().browse(new URI(url));


+ String url = request.getParameter("url");
+ URI uri = new URI(url);
+ if (uri.getScheme().equals("https") || uri.getScheme().equals("http")) {
+ Desktop.getDesktop().browse(uri);


+
+ // Weak check - only checks if scheme exists, not what it is
+ if (uri.getScheme() != null) {
+ Desktop.getDesktop().browse(uri);


+ public void bad6_rundll32(HttpServletRequest request) throws IOException {
+ String url = request.getParameter("url");
+ // ProcessBuilder with list
+ ProcessBuilder pb = new ProcessBuilder("rundll32", "url.dll,FileProtocolHandler", url);


… platforms

github-advanced-securityAI found potential problems Dec 17, 2025
View reviewed changes

ex0dus-0x changed the title ~~Add PotentiallyUnguardedProtocolHandler query for Java~~Add PotentiallyUnguardedProtocolHandler query for Java and C++Dec 17, 2025

github-advanced-securityAI found potential problems Dec 17, 2025
View reviewed changes

ex0dus-0x force-pushed the alan/untrusted-protocol-handle branch from c3d12d8 to 3275b0dCompare January 2, 2026 17:49

ex0dus-0x marked this pull request as ready for review January 8, 2026 14:29

ex0dus-0x requested review from GrosQuildu and fegge as code owners January 8, 2026 14:29

GrosQuildu reviewed Feb 12, 2026
View reviewed changes

Comment thread...ts/security/PotentiallyUnguardedProtocolHandler/PotentiallyUnguardedProtocolHandler.expected
Comment threadcpp/test/query-tests/security/PotentiallyUnguardedProtocolHandler/test.cpp Outdated

ex0dus-0x added 6 commits April 6, 2026 13:59

init: add PotentiallyUnguardedProtocolHandler query
05212aa

add legacy protocol handler support
4664d38

add support for C++/Qt, and genericize shell execution models for all…
b2d7c37
… platforms

fix java tests
7efd379

Add docs and fix CI/CD issue
4d28876

Fix up tests, and enhance query with better isBarrier
e0d42d1

ex0dus-0x force-pushed the alan/untrusted-protocol-handle branch from 29a9a76 to e0d42d1Compare April 6, 2026 18:00

ex0dus-0xand others added 5 commits April 15, 2026 13:31

Fix up tests
0139581

fix stubs to pass test
5fb4693

Merge branch 'main' into alan/untrusted-protocol-handle
b0f08a5

[fix] update MaD indices due to pinned version
4f7ae91

[fix]regenerate doc/QUERIES.md for new protocol handler queries
6d3eef8

kumarak requested review from GrosQuildu and tnytown June 18, 2026 13:20