Description

Detects potential Server-Side Request Forgery (SSRF) vulnerabilities when using Java's modern HttpClient (java.net.http package). SSRF occurs when an application can be tricked into making HTTP requests to unintended destinations, potentially allowing attackers to probe internal networks or access sensitive systems.

Detection Strategy

• Application imports and uses the java.net.http package for making HTTP requests

• HTTP requests are constructed using potentially untrusted or user-controlled URL/URI inputs

• The HttpClient.send() or HttpClient.sendAsync() methods are invoked to make outbound requests

Vulnerable code example

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class VulnerableSSRF {
    public void sendRequest(String userInput) throws Exception {
        // VULNERABLE: Using unvalidated user input directly in URI creation...

✅ Secure code example

import java.net.URI;
import java.net.URL;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.util.Set;

public class SafeSSRF {...