Java SSRF Findings

從 Java Controller 和 Service Layer 程式碼片段開始，追蹤輸入從路徑變數經過 URI 建構到 RestTemplate.exchange() sink 的過程。檢查相關的 CodeQL SSRF 分析如何處理允許清單中的基礎 URL 和 URI 驗證；完成的標準是確定這是一個可重現的 query 誤報，還是找出 triage 所需的缺失證據。

Hi Team,

Hope you're doing well!

Just adding this here as a question to check if anyone has any inputs or recommendations.

Description of issue

CWE-918 (SSRF) finding alert when input parameters are eventually appended to a URL used to make outbound calls to external systems in the source code.

However, the implementation includes multiple layers of mitigation, which I believe should prevent SSRF:

• The input string is validated via regex (alphanumeric + length check).
• A sanitization method strips any non-alphanumeric characters.-
• The base URL is sourced from a secure Spring Boot config (application.properties) using the @Value annotation.
• I’ve implemented an allow-list validation, ensuring the final URI starts with one of the expected base URLs.
• Despite these controls, CodeQL still flags the usage as SSRF in the RestTemplate.exchange() call.

Please refer to the code snippet below for reference:

Code samples or links to source code

Controller(source)

@RequestMapping(path = "{inputKey:^[a-zA-Z0-9]{8}$|^[a-zA-Z0-9]{10}$}", method = RequestMethod.GET, produces = MediaType.APPLICATION_JSON_VALUE)
@ApiResponses({ @ApiResponse(responseCode = "404", description = "Resource Not Found"),
       @ApiResponse(responseCode = "200", description = "OK") })
public ResourceResponse getURLsByIdentifier(
       @Parameter(description = "Enter inputKey.", name = "inputKey", required = true) @PathVariable("inputKey") String inputKey) {

    ###    Source inputKey
    return resourceService.getResourceUrls(sanitizeAlphanumeric(inputKey));
}

private String sanitizeAlphanumeric(String input) {
    if (input == null) return "";
    return input.replaceAll("[^a-zA-Z0-9]", "");
}

Service Layer (Sink)

//validated URL is being formed
URI configURI = UriComponentsBuilder.
        fromUriString(baseUrl) //baseURl is pickup from Spring config using @Value annotation
        .path(inputKey) // pased from controller
        .queryParam("config", "true")
        .build()
        .toUri();
		
HttpEntity<String> entity = new HttpEntity<>(getHeaders());

### Sink configURI
ResponseEntity<Map<String, Object>> response = restTemplate.exchange(configURI, HttpMethod.GET, entity,
        new ParameterizedTypeReference<>() {}); // Vunerbility reported here 

//have implemented a URL validation mechanism by maintaining a map of all allowed base URLs and verifying 
// whether the constructed configURI starts with one of the expected base URLs. However, this approach also did not help resolve the issue.

I’ve also verified that:

baseUrl is always from a known set of safe endpoints.
A custom check ensures the final URI starts with one of the allow-listed base URLs before making the request.

Appreciate any insights or suggestions. Happy to share more details if needed. Thanks in advance!