Zennoxa Shield
Rules / JavaScript / TypeScript
SHIELD-JS-016

Server-Side Request Forgery (SSRF) via user-controlled URL

highJavaScript / TypeScriptCWE-918CVSS 8.6

What it detects

Fetching URLs from user input without validation can allow SSRF attacks.

How to fix

Validate and allowlist URLs before making server-side HTTP requests.

Vulnerable — Shield flags thispreview.js
const express = require("express");
const app = express();

app.get("/preview", async (req, res) => {
  // ?url=http://169.254.169.254/latest/meta-data reaches internal services
  const response = await fetch(req.query.url);
  res.type("text").send(await response.text());
});
Fixed — scans cleanpreview.js
const express = require("express");
const app = express();

// Fetch only from a fixed allowlist of trusted upstreams
app.get("/preview", async (req, res) => {
  let url;
  switch (req.query.source) {
    case "status": url = "https://status.zennoxa.com/api/v2/status.json"; break;
    case "github": url = "https://api.github.com/zen"; break;
    default: return res.status(400).send("unknown source");
  }
  const response = await fetch(url);
  res.type("text").send(await response.text());
});

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-JS-016, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-JS-016: Server-Side Request Forgery (SSRF) via user-controlled URL — Zennoxa Shield