CWE-918 (SSRF) - Java - False Positive Justification

Revisa la validación mediante regex del controlador, la URL base de application.properties y el sink restTemplate.exchange de la capa de servicio. Compara este flujo reportado con el análisis de SSRF de Java de CodeQL; como no se menciona ningún archivo del repositorio, query ni test, el fix esperado no puede delimitarse solo a partir de este issue.

Description of the false positive

CWE-918 (SSRF) finding is triggered when input parameters are eventually appended to a URL used to make outbound calls to external systems in the source code.

In the implementation below, although the base URL is sourced from the Spring Boot configuration file (application.properties), and input parameter (a String) is validated using a regular expression to enforce a specific length and restrict it to alphanumeric characters. Still CodeQL flag as SSRF vunerbility

Please refer to the code snippet below for reference:

Code samples or links to source code

Controller(source)

@RequestMapping(path = "{inputKey:^[a-zA-Z0-9]{8}$|^[a-zA-Z0-9]{10}$}", method = RequestMethod.GET, produces = MediaType.APPLICATION_JSON_VALUE)
@ApiResponses({ @ApiResponse(responseCode = "404", description = "Resource Not Found"),
       @ApiResponse(responseCode = "200", description = "OK") })
public ResourceResponse getURLsByIdentifier(
       @Parameter(description = "Enter inputKey.", name = "inputKey", required = true) @PathVariable("inputKey") String inputKey) {

    ###    Source inputKey
    return resourceService.getResourceUrls(sanitizeAlphanumeric(inputKey));
}

private String sanitizeAlphanumeric(String input) {
    if (input == null) return "";
    return input.replaceAll("[^a-zA-Z0-9]", "");
}

Service Layer (Sink)

//validated URL is being formed
URI configURI = UriComponentsBuilder.
        fromUriString(baseUrl) //baseURl is pickup from Spring config using @Value annotation
        .path(inputKey) // pased from controller
        .queryParam("config", "true")
        .build()
        .toUri();
		
HttpEntity<String> entity = new HttpEntity<>(getHeaders());

### Sink configURI
ResponseEntity<Map<String, Object>> response = restTemplate.exchange(configURI, HttpMethod.GET, entity,
        new ParameterizedTypeReference<>() {}); // Vunerbility reported here 

//have implemented a URL validation mechanism by maintaining a map of all allowed base URLs and verifying 
// whether the constructed configURI starts with one of the expected base URLs. However, this approach also did not help resolve the issue.