class

Flaw::HttpUserUrl

Inherits Flaw::Rule < Reference < Object

FLAW011 — SSRF. HTTP::Client or HTTP.get/post/etc called with an interpolated URL whose host portion is user-controlled.

Constants

PATTERNS = [/\bHTTP::Client(?:\.new|\.(?:get|post|put|delete|head|patch|exec))\s*\(\s*"[^"]*\#\{/, /\bHTTP\.(?:get|post|put|delete|head|patch)\s*\(\s*"[^"]*\#\{/, /\bHTTP::Client\.new\s*\(\s*[a-z_]+\s*[,)]/]

HTTP::Client.get("https://#{host}/..."), HTTP::Client.new(host), HTTP.get(url)

Instance methods

check(source : String, path : String) : Array(Finding)

default_severity

description

title