Description

Detects Server-Side Request Forgery (SSRF) vulnerabilities in Go applications where unvalidated user input is used to construct HTTP request URLs. This could allow attackers to make unauthorized HTTP requests to internal or external systems through the vulnerable application.

Detection Strategy

• Code imports the 'net/http' package from Go standard library

• HTTP client methods like Get(), Post(), NewRequest() are called with parameters

• The URL or request parameters originate from user-controlled input without proper validation

• The user input flows into the HTTP request method without sufficient sanitization or checks

Vulnerable code example

package main

import (
    "net/http"
    "io"
)

func handler(w http.ResponseWriter, r *http.Request) {...

✅ Secure code example

package main

import (
    "net/http"
    "net/url"
    "io"
)
...