Description

Detects potential Server-Side Request Forgery (SSRF) vulnerabilities in TypeScript applications using the wkhtmltopdf library. The vulnerability occurs when untrusted input is passed directly to wkhtmltopdf functions without proper validation, allowing an attacker to make arbitrary network requests or access internal resources.

Detection Strategy

• Check if the source file imports or requires the wkhtmltopdf module

• Look for function calls to wkhtmltopdf where the first argument (URL/input parameter) comes from an untrusted source

• Report a vulnerability if user-controllable data flows into wkhtmltopdf function calls without proper validation or sanitization

Vulnerable code example

const wkhtmltopdf = require('wkhtmltopdf');

function generatePDF(req, res) {
  const userUrl = req.query.url;  // User-controlled input creates injection risk
  // Vulnerable: Direct use of user input in wkhtmltopdf
  wkhtmltopdf(userUrl, { quiet: true }).pipe(res);
}

✅ Secure code example

const wkhtmltopdf = require('wkhtmltopdf');

function isValidHttpsUrl(url) {
  try {
    const urlObj = new URL(url);
    return urlObj.protocol === 'https:';  // Only allow HTTPS URLs
  } catch {
    return false;...