Description

Detects potential integer overflow vulnerabilities in Scala applications using the Play Framework. This vulnerability can occur when request parameters containing large numbers are improperly handled, potentially leading to arithmetic overflows that could cause unexpected application behavior or security issues.

Detection Strategy

• Application code must be using Play Framework (specifically imports from play.api.mvc)

• Code must be handling HTTP request parameters or query parameters

• The request parameter values must be used in arithmetic operations within the execution block

• Analysis checks if the request parameters are properly bounds-checked before arithmetic operations

Vulnerable code example

import play.api.mvc._

def unsafeOperation(request: Request[AnyContent]) = {
    val userInput = request.getQueryString("value").getOrElse("0") // Source: untrusted user input
    val number = userInput.toInt
    val result = number * 1000000  // Vulnerable: unchecked multiplication can cause integer overflow
    Ok(result.toString)
}

✅ Secure code example

import play.api.mvc._

def safeOperation(request: Request[AnyContent]) = {
    val userInput = request.getQueryString("value").getOrElse("0")
    // Safe: Convert string to Int with error handling
    val number = scala.util.Try(userInput.toInt).getOrElse(0)
    
    // Safe: Check bounds before multiplication to prevent overflow...