rspec/rules/S5144/javascript/rule.adoc

include::../description.adoc[]

== Noncompliant Code Example

[source,javascript]
----
const request = require('request');

function ssrf(req, res) {
  const url = req.query.url; 

  request(url, callback); // Noncompliant
}
----

== Compliant Solution

Validate the url with an allowlist:

[source,javascript]
----
const request = require('request'); 

function ssrf(req, res) {
  const white_list = [ "www.example.com", "example.com" ]

  const url             = (new URL(req.query.url));
  const remote_hostname = url.hostname;

  if (white_list.includes(remote_hostname)) {
    request(url, callback);
  }
}
----

include::../see.adoc[]
ifdef::env-github,rspecator-view[]

'''
== Implementation Specification
(visible only on this page)

include::../message.adoc[]

include::../highlighting.adoc[]

endif::env-github,rspecator-view[]