48 lines
846 B
Plaintext
48 lines
846 B
Plaintext
include::../description.adoc[]
|
||
|
||
== Noncompliant Code Example
|
||
|
||
[source,javascript]
|
||
----
|
||
const request = require('request');
|
||
|
||
function ssrf(req, res) {
|
||
const url = req.query.url;
|
||
|
||
request(url, callback); // Noncompliant
|
||
}
|
||
----
|
||
|
||
== Compliant Solution
|
||
|
||
Validate the url with an allowlist:
|
||
|
||
[source,javascript]
|
||
----
|
||
const request = require('request');
|
||
|
||
function ssrf(req, res) {
|
||
const white_list = [ "www.example.com", "example.com" ]
|
||
|
||
const url = (new URL(req.query.url));
|
||
const remote_hostname = url.hostname;
|
||
|
||
if (white_list.includes(remote_hostname)) {
|
||
request(url, callback);
|
||
}
|
||
}
|
||
----
|
||
|
||
include::../see.adoc[]
|
||
ifdef::env-github,rspecator-view[]
|
||
|
||
'''
|
||
== Implementation Specification
|
||
(visible only on this page)
|
||
|
||
include::../message.adoc[]
|
||
|
||
include::../highlighting.adoc[]
|
||
|
||
endif::env-github,rspecator-view[]
|