CWE-918 (SSRF) - Java - False Positive Justification

Rà soát phần xác thực regex của controller, base URL trong application.properties và sink restTemplate.exchange ở tầng service. So sánh flow được báo cáo này với phân tích Java SSRF của CodeQL; vì không có file, query hay test nào trong repository được nêu tên, không thể xác định phạm vi fix dự kiến chỉ từ issue này.

Description of the false positive

CWE-918 (SSRF) finding is triggered when input parameters are eventually appended to a URL used to make outbound calls to external systems in the source code.

In the implementation below, although the base URL is sourced from the Spring Boot configuration file (application.properties), and input parameter (a String) is validated using a regular expression to enforce a specific length and restrict it to alphanumeric characters. Still CodeQL flag as SSRF vunerbility

Please refer to the code snippet below for reference:

Code samples or links to source code

Controller(source)

@RequestMapping(path = "{inputKey:^[a-zA-Z0-9]{8}$|^[a-zA-Z0-9]{10}$}", method = RequestMethod.GET, produces = MediaType.APPLICATION_JSON_VALUE)
@ApiResponses({ @ApiResponse(responseCode = "404", description = "Resource Not Found"),
       @ApiResponse(responseCode = "200", description = "OK") })
public ResourceResponse getURLsByIdentifier(
       @Parameter(description = "Enter inputKey.", name = "inputKey", required = true) @PathVariable("inputKey") String inputKey) {

    ###    Source inputKey
    return resourceService.getResourceUrls(sanitizeAlphanumeric(inputKey));
}

private String sanitizeAlphanumeric(String input) {
    if (input == null) return "";
    return input.replaceAll("[^a-zA-Z0-9]", "");
}

Service Layer (Sink)

//validated URL is being formed
URI configURI = UriComponentsBuilder.
        fromUriString(baseUrl) //baseURl is pickup from Spring config using @Value annotation
        .path(inputKey) // pased from controller
        .queryParam("config", "true")
        .build()
        .toUri();
		
HttpEntity<String> entity = new HttpEntity<>(getHeaders());

### Sink configURI
ResponseEntity<Map<String, Object>> response = restTemplate.exchange(configURI, HttpMethod.GET, entity,
        new ParameterizedTypeReference<>() {}); // Vunerbility reported here 

//have implemented a URL validation mechanism by maintaining a map of all allowed base URLs and verifying 
// whether the constructed configURI starts with one of the expected base URLs. However, this approach also did not help resolve the issue.