detecting-file-upload-vulnerabilities

Run the scan_upload.py script against the project source; it detects the stack, applies Semgrep rules for transferTo() without validation, getRealPath() storage, and getOriginalFilename() misuse, then AI verification confirms which candidates are real vulnerabilities.

CWE-434 is the unrestricted upload of files with dangerous types. When a server accepts files without extension whitelists or magic-byte checks, attackers can upload web shells like .jsp files and execute commands on the server via HTTP requests.

Yes, it falls back to regex-based grep scanning when Semgrep is unavailable. The fallback has lower recall, so the tool prints a warning and relies more heavily on AI context verification for final judgments.

Yes, it detects jsp-legacy stacks via web.xml, .jsp files, and commons-fileupload usage. It checks whether FileValidator.validate() precedes transferTo() calls and whether upload paths stay outside the web root.

Static patterns alone cannot tell whether validation is encapsulated in shared handlers like FileUtils.validateFile(). The scanner intentionally collects broad candidates, and AI verification reads the surrounding code and config files to confirm or dismiss each finding.

Skip it for pure APIs with no file upload functionality, or when the concern is download path validation, which belongs to path traversal detection instead. It targets upload-side CWE-434 risks only.