Zennoxa Shield
Rules / Kotlin
SHIELD-KOTLIN-012

SSRF via URL(variable).openConnection

highKotlinCWE-918CVSS 8.6

What it detects

Opening a connection to a URL built from a variable can let an attacker reach internal services (SSRF).

How to fix

Validate the target host against an allowlist and reject internal or link-local addresses.

Vulnerable — Shield flags thisPreviewService.kt
import java.net.HttpURLConnection
import java.net.URL
import javax.servlet.http.HttpServletRequest

fun fetchPreview(req: HttpServletRequest): String {
    val target = req.getParameter("url") ?: return ""
    val conn = URL(target).openConnection() as HttpURLConnection
    return conn.inputStream.bufferedReader().readText()
}
Fixed — scans cleanPreviewService.kt
import java.net.HttpURLConnection
import java.net.URL
import javax.servlet.http.HttpServletRequest

private val ALLOWED_HOSTS = setOf("status.example.com", "api.example.com")

fun fetchPreview(req: HttpServletRequest): String {
    val host = req.getParameter("host") ?: return ""
    require(host in ALLOWED_HOSTS) { "host not allowed" }
    val conn = URL("https://$host/status").openConnection() as HttpURLConnection
    return conn.inputStream.bufferedReader().readText()
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-KOTLIN-012, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-KOTLIN-012: SSRF via URL(variable).openConnection — Zennoxa Shield