Server-Side Request Forgery (SSRF)

  package main
  
  import (
      "io"
-     "net/http"
- )
- 
- func handler(w http.ResponseWriter, r *http.Request) {
-     targetURL := r.URL.Query().Get("url")
-     // Vulnerable: user-controlled URL
-     resp, err := http.Get(targetURL)
-     if err != nil {
-         http.Error(w, err.Error(), 500)
-         return
-     }
+     "net"
+     "net/http"
+     "net/url"
+ )
+ 
+ var allowedDomains = map[string]bool{
+     "api.example.com": true,
+     "cdn.example.com": true,
+ }
+ 
+ func isPrivateIP(ip net.IP) bool {
+     private := []string{
+         "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16",
+         "169.254.0.0/16", "127.0.0.0/8",
+     }
+     for _, cidr := range private {
+         _, network, _ := net.ParseCIDR(cidr)
+         if network.Contains(ip) {
+             return true
+         }
+     }
+     return false
+ }
+ 
+ func handler(w http.ResponseWriter, r *http.Request) {
+     targetURL := r.URL.Query().Get("url")
+ 
+     parsed, err := url.Parse(targetURL)
+     if err != nil {
+         http.Error(w, "Invalid URL", 400)
+         return
+     }
+ 
+     // Validate scheme
+     if parsed.Scheme != "https" {
+         http.Error(w, "HTTPS required", 400)
+         return
+     }
+ 
+     // Validate domain
+     if !allowedDomains[parsed.Host] {
+         http.Error(w, "Domain not allowed", 403)
+         return
+     }
+ 
+     // Block private IPs (DNS rebinding protection)
+     ips, _ := net.LookupIP(parsed.Hostname())
+     for _, ip := range ips {
+         if isPrivateIP(ip) {
+             http.Error(w, "Private IP not allowed", 403)
+             return
+         }
+     }
+ 
+     resp, _ := http.Get(targetURL)
      defer resp.Body.Close()
      io.Copy(w, resp.Body)
  }
  

  'use server'
- 
- export async function fetchData(url: string) {
-   const response = await fetch(url);
-   return await response.json();
+ const ALLOWED_DOMAINS = ['api.example.com', 'cdn.example.com'];
+ 
+ export async function fetchData(url: string) {
+   const parsed = new URL(url);
+   if (!ALLOWED_DOMAINS.includes(parsed.hostname)) {
+     throw new Error('URL not allowed');
+   }
+   return await fetch(url).then(r => r.json());
  }
  

  const http = require('http');
- 
- function fetchUrl(url) {
-   // Vulnerable: no URL validation
-   return new Promise((resolve, reject) => {
-     http.get(url, (res) => {
+ const https = require('https');
+ 
+ const ALLOWED_DOMAINS = ['api.example.com', 'cdn.example.com'];
+ 
+ function fetchUrl(url) {
+   const parsed = new URL(url);
+ 
+   // Validate protocol
+   if (!['http:', 'https:'].includes(parsed.protocol)) {
+     throw new Error('Invalid protocol');
+   }
+ 
+   // Validate against allowlist
+   if (!ALLOWED_DOMAINS.includes(parsed.hostname)) {
+     throw new Error('Domain not allowed');
+   }
+ 
+   // Block private/internal IPs
+   if (isPrivateIP(parsed.hostname)) {
+     throw new Error('Private IP not allowed');
+   }
+ 
+   const client = parsed.protocol === 'https:' ? https : http;
+   return new Promise((resolve, reject) => {
+     client.get(url, (res) => {
        let data = '';
        res.on('data', chunk => data += chunk);
        res.on('end', () => resolve(data));
      }).on('error', reject);
    });
  }