Description

Detects path traversal vulnerabilities in Scala Play Framework applications where user-controlled file paths are used without proper validation. This could allow attackers to access files outside intended directories by manipulating path parameters using "../" sequences.

Detection Strategy

• Confirms the Play Framework MVC library (play.api.mvc) is imported in the codebase

• Identifies function calls that handle file paths (like file read/write operations)

• Checks if the file path parameter comes from user-controllable input like request parameters

• Reports a vulnerability when file operations use unvalidated path input that could allow directory traversal

Vulnerable code example

import play.api.mvc._
import java.io.File

object FileController {
  def downloadFile = Action { request =>
    val baseDir = "resources/data"
    val filename = request.getQueryString("file").getOrElse("default.txt")
    // Vulnerable: Untrusted user input flows directly into File constructor...

✅ Secure code example

import play.api.mvc._
import java.io.File
import org.apache.commons.io.FilenameUtils

object FileController {
  def downloadFile = Action { request =>
    val baseDir = "resources/data"
    ...