Server-Side Request Forgery (SSRF)

@RestController
public class WebhookController {

    @Autowired
    private RestTemplate restTemplate;

    // Allowlist of permitted domains
    private static final Set<String> ALLOWED_DOMAINS = Set.of(
        "api.example.com",
        "webhook.partner.com"
    );

    @PostMapping("/api/fetch-url")
    public ResponseEntity<String> fetchUrl(@RequestBody UrlRequest request) {
        String url = request.getUrl();

        // SECURE: Comprehensive URL validation
        if (!isUrlSafe(url)) {
            return ResponseEntity.badRequest()
                .body("URL not allowed");
        }

        try {
            ResponseEntity<String> response = restTemplate.getForEntity(
                url,
                String.class
            );
            return ResponseEntity.ok(response.getBody());
        } catch (Exception e) {
            return ResponseEntity.status(500)
                .body("Error fetching URL");
        }
    }

    private boolean isUrlSafe(String urlString) {
        try {
            URL url = new URL(urlString);

            // 1. Only allow HTTP/HTTPS protocols
            String protocol = url.getProtocol().toLowerCase();
            if (!protocol.equals("http") && !protocol.equals("https")) {
                return false;
            }

            // 2. Domain must be in allowlist
            String host = url.getHost().toLowerCase();
            if (!ALLOWED_DOMAINS.contains(host)) {
                return false;
            }

            // 3. Resolve hostname and block internal IPs
            InetAddress address = InetAddress.getByName(host);
            if (address.isLoopbackAddress() ||
                address.isLinkLocalAddress() ||
                address.isSiteLocalAddress()) {
                return false;
            }

            // 4. Block cloud metadata endpoint
            if (address.getHostAddress().equals("169.254.169.254")) {
                return false;
            }

            return true;
        } catch (Exception e) {
            return false;
        }
    }
}

// Now attackers cannot:
// - Access localhost or internal IPs
// - Use non-HTTP protocols (file://, gopher://, etc.)
// - Reach cloud metadata endpoints
// - Access domains not in the allowlist