Server-Side Request Forgery (ARCH8104)
Key kotlin.security.ssrf · Severity warning · Category security · CWE CWE-918
Flags outbound requests (URL(...), HttpUrl.parse, OkHttp Request.Builder().url) whose destination comes from request or parameter data.
Incorrect
Section titled “Incorrect”val target = URL(request.getParameter("url"))target.openStream()Correct
Section titled “Correct”val target = URL(request.getParameter("url"))require(target.host in allowedHosts)Allowlist hosts, refuse loopback and link-local addresses, resolve before connecting.