CWE-918 (SSRF) - Java - False Positive Justification

controller の regex 検証、application.properties のベース URL、およびサービス層の restTemplate.exchange sink を確認してください。報告されたこのフローを CodeQL の Java SSRF 分析と比較してください。リポジトリのファイル、query、test のいずれも名前が示されていないため、期待される fix の範囲をこの issue だけから特定することはできません。

Description of the false positive

CWE-918 (SSRF) finding is triggered when input parameters are eventually appended to a URL used to make outbound calls to external systems in the source code.

In the implementation below, although the base URL is sourced from the Spring Boot configuration file (application.properties), and input parameter (a String) is validated using a regular expression to enforce a specific length and restrict it to alphanumeric characters. Still CodeQL flag as SSRF vunerbility

Please refer to the code snippet below for reference:

Code samples or links to source code

Controller(source)

@RequestMapping(path = "{inputKey:^[a-zA-Z0-9]{8}$|^[a-zA-Z0-9]{10}$}", method = RequestMethod.GET, produces = MediaType.APPLICATION_JSON_VALUE)
@ApiResponses({ @ApiResponse(responseCode = "404", description = "Resource Not Found"),
       @ApiResponse(responseCode = "200", description = "OK") })
public ResourceResponse getURLsByIdentifier(
       @Parameter(description = "Enter inputKey.", name = "inputKey", required = true) @PathVariable("inputKey") String inputKey) {

    ###    Source inputKey
    return resourceService.getResourceUrls(sanitizeAlphanumeric(inputKey));
}

private String sanitizeAlphanumeric(String input) {
    if (input == null) return "";
    return input.replaceAll("[^a-zA-Z0-9]", "");
}

Service Layer (Sink)

//validated URL is being formed
URI configURI = UriComponentsBuilder.
        fromUriString(baseUrl) //baseURl is pickup from Spring config using @Value annotation
        .path(inputKey) // pased from controller
        .queryParam("config", "true")
        .build()
        .toUri();
		
HttpEntity<String> entity = new HttpEntity<>(getHeaders());

### Sink configURI
ResponseEntity<Map<String, Object>> response = restTemplate.exchange(configURI, HttpMethod.GET, entity,
        new ParameterizedTypeReference<>() {}); // Vunerbility reported here 

//have implemented a URL validation mechanism by maintaining a map of all allowed base URLs and verifying 
// whether the constructed configURI starts with one of the expected base URLs. However, this approach also did not help resolve the issue.