Server-side request forgery (ARCH6104)

Key ruby.security.ssrf · Severity warning · Category security · CWE CWE-918

Making an outbound request to a user-supplied URL without validation lets attackers force the server to reach internal services or cloud metadata endpoints.

Incorrect

def fetch(url)
  Net::HTTP.get(URI(url))
end

Correct

ALLOWED = %w[api.partner.com cdn.partner.com].freeze

def fetch(url)
  uri = URI(url)
  raise "blocked host" unless ALLOWED.include?(uri.host)
  Net::HTTP.get(uri)
end

Fix

Validate outbound URLs against an allowlist; block private IP ranges and metadata endpoints.