From 83a55ced6e7d25fef1e5192d94141da0152da723 Mon Sep 17 00:00:00 2001 From: Arshan Dabirsiaghi Date: Fri, 23 Aug 2024 09:24:22 -0400 Subject: [PATCH] Update SSRF sandbox control message to be more explicit (#442) A user requested that the SSRF codemod present a more clear, explicit explanation of what the change will do. --- .../resources/io/codemodder/codemods/SSRFCodemod/report.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/core-codemods/src/main/resources/io/codemodder/codemods/SSRFCodemod/report.json b/core-codemods/src/main/resources/io/codemodder/codemods/SSRFCodemod/report.json index 415cf2e8a..4f759a7ed 100644 --- a/core-codemods/src/main/resources/io/codemodder/codemods/SSRFCodemod/report.json +++ b/core-codemods/src/main/resources/io/codemodder/codemods/SSRFCodemod/report.json @@ -1,7 +1,7 @@ { "summary" : "Sandboxed URL creation to prevent SSRF attacks", "control" : "https://github.com/pixee/java-security-toolkit/blob/main/src/main/java/io/github/pixee/security/Urls.java", - "change": "Wrapped the URL creation with a method that forces the caller to pick allowed protocols and domains that this URL can reach", + "change": "Added a control method that limits the protocols to HTTP(S) and limits the host to non-infrastructure targets (e.g., blocks AWS metadata hosts, typical network gateway addresses.)", "reviewGuidanceJustification" : "By default, the protection only weaves in 2 checks, which we believe will not cause any issues with the vast majority of code:\n* The given URL must be HTTP/HTTPS.\n* The given URL must not point to a \"well-known infrastructure target\", which includes things like AWS Metadata Service endpoints, and internal routers (e.g., 192.168.1.1) which are common targets of attacks.\n\nHowever, on rare occasions an application may use a URL protocol like \"file://\" or \"classpath://\" in backend or middleware code.\n\nIf you want to allow those protocols, change the incoming PR to look more like this and get the best security possible:\n\n```\n-URL u = new URL(url);\n+Set fileProtocols = Set.of(UrlProtocol.FILE, UrlProtocol.CLASSPATH);\n+URL u = Urls.create(url, fileProtocols);\n```",