CWE-918 (SSRF) - Java - False Positive Justification

Esamina la validazione regex del controller, la URL di base di application.properties e il sink restTemplate.exchange a livello di servizio. Confronta questo flusso segnalato con l'analisi SSRF Java di CodeQL; poiché non sono indicati alcun file del repository, query o test, il fix previsto non può essere circoscritto sulla base di questo issue.

Description of the false positive

CWE-918 (SSRF) finding is triggered when input parameters are eventually appended to a URL used to make outbound calls to external systems in the source code.

In the implementation below, although the base URL is sourced from the Spring Boot configuration file (application.properties), and input parameter (a String) is validated using a regular expression to enforce a specific length and restrict it to alphanumeric characters. Still CodeQL flag as SSRF vunerbility

Please refer to the code snippet below for reference:

Code samples or links to source code

Controller(source)

@RequestMapping(path = "{inputKey:^[a-zA-Z0-9]{8}$|^[a-zA-Z0-9]{10}$}", method = RequestMethod.GET, produces = MediaType.APPLICATION_JSON_VALUE)
@ApiResponses({ @ApiResponse(responseCode = "404", description = "Resource Not Found"),
       @ApiResponse(responseCode = "200", description = "OK") })
public ResourceResponse getURLsByIdentifier(
       @Parameter(description = "Enter inputKey.", name = "inputKey", required = true) @PathVariable("inputKey") String inputKey) {

    ###    Source inputKey
    return resourceService.getResourceUrls(sanitizeAlphanumeric(inputKey));
}

private String sanitizeAlphanumeric(String input) {
    if (input == null) return "";
    return input.replaceAll("[^a-zA-Z0-9]", "");
}

Service Layer (Sink)

//validated URL is being formed
URI configURI = UriComponentsBuilder.
        fromUriString(baseUrl) //baseURl is pickup from Spring config using @Value annotation
        .path(inputKey) // pased from controller
        .queryParam("config", "true")
        .build()
        .toUri();
		
HttpEntity<String> entity = new HttpEntity<>(getHeaders());

### Sink configURI
ResponseEntity<Map<String, Object>> response = restTemplate.exchange(configURI, HttpMethod.GET, entity,
        new ParameterizedTypeReference<>() {}); // Vunerbility reported here 

//have implemented a URL validation mechanism by maintaining a map of all allowed base URLs and verifying 
// whether the constructed configURI starts with one of the expected base URLs. However, this approach also did not help resolve the issue.