Zennoxa Shield
Rules / Dart
SHIELD-DART-011

SSRF via user-controlled request URL

highDartCWE-918CVSS 8.6

What it detects

Passing a variable URL into an HTTP request lets an attacker force requests to internal services.

How to fix

Validate the URL against an allowlist of trusted hosts before making the request.

Vulnerable — Shield flags thispreview.dart
import 'package:http/http.dart' as http;

Future<String> fetchPreview(String url) async {
  final res = await http.get(Uri.parse(url));
  return res.body;
}
Fixed — scans cleanpreview.dart
import 'package:http/http.dart' as http;

const allowedHosts = {'api.example.com', 'cdn.example.com'};

Future<String> fetchPreview(String url) async {
  final uri = Uri.parse(url);
  if (!allowedHosts.contains(uri.host)) throw ArgumentError('host not allowed');
  final res = await http.get(uri);
  return res.body;
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-DART-011, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-DART-011: SSRF via user-controlled request URL — Zennoxa Shield