Zennoxa Shield
Rules / Java
SHIELD-JAVA-012

SSRF via URL openConnection

highJavaCWE-918CVSS 8.6

What it detects

Opening a connection to a URL built from a variable host allows server-side request forgery.

How to fix

Validate the target against an allowlist of permitted hosts and protocols before connecting.

Vulnerable — Shield flags thisUrlFetcher.java
import java.io.InputStream;
import java.net.URL;
import java.net.URLConnection;

public class UrlFetcher {
    // "url" comes straight from the request body of POST /webhooks/test
    public InputStream fetchPreview(String url) throws Exception {
        URLConnection conn = new URL(url).openConnection();
        conn.setConnectTimeout(5000);
        return conn.getInputStream();
    }
}
Fixed — scans cleanUrlFetcher.java
import java.net.HttpURLConnection;
import java.net.URI;
import java.util.Set;

public class UrlFetcher {
    private static final Set<String> ALLOWED_HOSTS = Set.of("hooks.example.com");

    public HttpURLConnection fetchPreview(String url) throws Exception {
        URI target = URI.create(url);
        if (!"https".equals(target.getScheme()) || !ALLOWED_HOSTS.contains(target.getHost())) {
            throw new IllegalArgumentException("URL not in allowlist");
        }
        return (HttpURLConnection) target.toURL().openConnection();
    }
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-JAVA-012, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-JAVA-012: SSRF via URL openConnection — Zennoxa Shield