CWE-99 Resource Injection
What this means
SiteShadow flagged resource identifiers (filenames, URLs, bucket keys, template names) being constructed from untrusted input, allowing an attacker to select unexpected resources.
Why it matters
Attackers can access unexpected resources or files.
- Sensitive file access if resource selection maps to filesystem paths.
- SSRF or data exfiltration if resource selection controls outbound fetches.
- Authorization bypass if users can select resources they shouldn't access.
Safer examples
1) Use allowlists for resource selection
const allowed = { summary: "/reports/summary.json", invoice: "/reports/invoice.csv" };
const key = req.query.type in allowed ? req.query.type : "summary";
const path = allowed[key];2) Enforce base directories / trusted hosts
For paths: normalize and enforce base directories. For URLs: allowlist hosts (see CWE-23/36 and CWE-918).
3) Add authorization at the resource level
Even if a resource exists, verify the requester is allowed to access it.
How SiteShadow detects it (high level)
- Detects resource/path/url construction from request-derived values.
- Flags when resource selectors are not allowlisted or validated, especially near file/HTTP sinks.
References
- CWE-99: https://cwe.mitre.org/data/definitions/99.html
---