# Server-Side Request Forgery (SSRF) (CWE-918)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

**Stack:** Python

- Prevalence: Média 3 linguagens cobertas
- Impact: Alto 4 regras de severidade alta
- Prevention: Documentada 4 exemplos de correção

**OWASP:** Server-Side Request Forgery (A10:2021-Server-Side Request Forgery) - #10

## Description

By providing URLs to unexpected hosts or ports, attackers can make it appear that the server is sending the request, possibly bypassing access controls such as firewalls.

## Prevention

Estratégias de prevenção para Server-Side Request Forgery baseadas em 1 regras de detecção do Shoulder.

### Python

Validate URLs against an allowlist of permitted domains

## Warning Signs

- [HIGH] user input controlling URLs in HTTP requests, allowing requests to
arbitrary destinations including 

## Consequences

- Ler dados da aplicação
- Burlar mecanismo de proteção
- Executar comandos não autorizados

## Mitigations

- Use uma allowlist dos destinos permitidos
- Desative esquemas de URL desnecessários (file://, gopher://)
- Use segmentação em nível de rede

## Detection

- Total rules: 4
- Languages: go, javascript, typescript, python

## Rules by Language

### Python (1 rules)

- **Server-Side Request Forgery (SSRF)** [HIGH]: Detects user input controlling URLs in HTTP requests, allowing requests to
arbitrary destinations including internal services and cloud metadata endpoints.
  - Remediation: Validate URLs against an allowlist of permitted domains.

```python
from urllib.parse import urlparse

ALLOWED_DOMAINS = {"api.github.com", "api.example.com"}
parsed = urlparse(user_url)
if parsed.hostname not in ALLOWED_DOMAINS:
    return "Invalid domain", 400
```

Learn more: https://shoulder.dev/learn/python/cwe-918/ssrf