Server-side request forgery (ARCH4104)

Key java.security.ssrf · Severity warning · Category security · CWE CWE-918

Making an outbound request to a user-supplied URL without validation lets attackers force the server to reach internal services, cloud metadata endpoints, or local resources.

Incorrect

String url = request.getParameter("url");
HttpRequest req = HttpRequest.newBuilder(URI.create(url)).build();
client.send(req, BodyHandlers.ofString());

Correct

URI uri = URI.create(request.getParameter("url"));
if (!ALLOWED_HOSTS.contains(uri.getHost()))
    throw new SecurityException();
HttpRequest req = HttpRequest.newBuilder(uri).build();
client.send(req, BodyHandlers.ofString());

Fix

Validate outbound request URLs against an allowlist; block private IP ranges and metadata endpoints.