Server fetches a URL from the request (SSRF)
Scan rule · RSC-SEC-144
- Security
- Severity: High
- CWE-918
- OWASP A10-2021
Finds server code that calls `fetch`, axios, got or ky with a URL from the request body, query or path — without an allowlist and without checking the host.
Why this matters
Link preview, image proxy, “analyse a website”: AI generators like to build these functions and almost always the same way — the URL comes from the body and goes straight into `fetch`. In a study by Tenzai all five tested coding agents built exactly this flaw.
The server then fetches any address a stranger hands it: internal services, cloud metadata endpoints, admin interfaces on the same network — with your server's network address and rights. Whatever comes back often lands straight in the response.
Fix: parse `new URL(url)` before fetching, restrict the protocol to https and the `hostname` to a fixed list. Where arbitrary targets are intended (link previews), reject private address ranges after DNS resolution and do not follow redirects automatically.
Scan tier
- Source code from source maps
- Repo access (deep scan)
How to fix it
Check the target host against a fixed allowlist (`new URL(url).hostname`), allow https only and reject private and local addresses.