Java: SSRF query #3720
Closed
Java: SSRF query #3720
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
1 task
Marcono1234
reviewed
Jun 16, 2020
|
Hello, apologies for our slow response on this: we've been backlogged with requests and are just now clearing the queue. Because this PR has the same topic as #3454 but was both submitted later and has a smaller feature-set (e.g., the other PR supports a broader range of HTTP client libraries), I'm sorry to say we can't accept this submission. If you are able to improve upon that PR, please do submit changes based on top of that branch, and we will be happy to assess their contribution relative to the baseline. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Server Side Request Forgery (SSRF) is an attack vector that abuses an application to interact with the internal/external network or the machine itself, frequently through the attack vector of URL mishandling.
In an SSRF attack, the attacker can abuse functionality on the server to read or update internal resources, e.g. cloud server meta-data, internal REST interface, and protected files.
This query detects the following two scenarios:
There are two existing queries in the CodeQL repository that handle two important/specific cases of this vulnerability category:
Thus this query has a broader scope and also covers the frequently used Apache HTTP library.
Please consider to merge the PR. Thanks.