Avoid potential server side request forgeries (SSRFs) This product is not supported for your selected
Datadog site . (
).
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel,
n'hésitez pas à nous contacter .
TRY THIS RULE ID: csharp-security/avoid-potential-ssrf
Language: C#
Severity: Error
Category: Security
CWE : 918
Description No description found
Non-Compliant Code Examples using System.Net.Http ;
using Microsoft.AspNetCore.Mvc ;
public class DocumentController : Controller
{
private readonly HttpClient _httpClient ;
public DocumentController ( HttpClient httpClient )
{
_httpClient = httpClient ;
}
[HttpPost]
public async Task < IActionResult > FetchDocument ( string documentUrl )
{
var response = await _httpClient . GetAsync ( documentUrl ); // Noncompliant
var content = await response . Content . ReadAsStringAsync ();
return Content ( content );
}
}
Compliant Code Examples public class DocumentController : Controller
{
private readonly HttpClient _httpClient ;
private readonly HashSet < string > _allowedHosts = new ()
{
"api.company.com" ,
"documents.trusted.org"
};
public DocumentController ( HttpClient httpClient )
{
_httpClient = httpClient ;
}
[HttpPost]
public async Task < IActionResult > FetchDocument ( string documentUrl )
{
if (! Uri . TryCreate ( documentUrl , UriKind . Absolute , out Uri uri ))
{
return BadRequest ( "Invalid URL format" );
}
if ( uri . Scheme != "https" || ! _allowedHosts . Contains ( uri . Host ))
{
return BadRequest ( "URL not allowed" );
}
var response = await _httpClient . GetAsync ( documentUrl );
var content = await response . Content . ReadAsStringAsync ();
return Content ( content );
}
}
