Server-Side Request Forgery (SSRF)

Description

Detects user input controlling URLs in HTTP requests, allowing requests to arbitrary destinations including internal services and cloud metadata endpoints.

How to fix

Validate URLs against an allowlist of permitted domains.

```python
from urllib.parse import urlparse

ALLOWED_DOMAINS = {"api.github.com", "api.example.com"}
parsed = urlparse(user_url)
if parsed.hostname not in ALLOWED_DOMAINS:
    return "Invalid domain", 400
```

Learn more: https://shoulder.dev/learn/python/cwe-918/ssrf

Applies to

References

Scan for this issue

Real-world examples

Known CVEs in the Server-Side Request Forgery vulnerability class that this rule helps detect.

Related rules