[Java] CWE-918: Query for server side request forgery (SSRF) detection #80

CVE ID(s)

None

Report

If network request are made using java.net.URL constructed directly from a user-provided value, an attacker might be able to bypass security restrictions such as external firewalls and execute request on internal services by providing URLs like http://127.0.0.1:8081/admin

Related pull request:
github/codeql#3452

• Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc). We would love to have you spread the word about the good work you are doing