Server-Side Request Forgery (SSRF)

Description

Detects user input flowing to HTTP client requests, enabling Server-Side Request Forgery attacks.

What Shoulder detects

Untrusted input from {source} reaches HTTP request at {sink}.
This allows an attacker to make the server perform requests to arbitrary URLs,
potentially accessing internal services or performing port scanning.

How to fix

Validate URLs against an allowlist of permitted domains.

```go
allowed := map[string]bool{"api.example.com": true}
parsed, _ := url.Parse(targetURL)
if !allowed[parsed.Host] {
    return errors.New("domain not allowed")
}
```

Learn more: https://shoulder.dev/learn/go/cwe-918/ssrf