Rules / Python
SHIELD-PY-007
Server-Side Request Forgery (SSRF) via requests with user input
What it detects
Making HTTP requests to user-controlled URLs may allow SSRF.
How to fix
Validate and allowlist URLs before making outbound HTTP requests.
Vulnerable — Shield flags thispreview.py
import requests
from flask import Flask, request
app = Flask(__name__)
@app.route("/preview")
def preview():
resp = requests.get(request.args.get("url", ""), timeout=5)
return resp.text
Fixed — scans cleanpreview.py
import requests
from flask import Flask, request
app = Flask(__name__)
# Only fetch from our own API host — never a raw user-supplied URL.
API_BASE = "https://api.partner.example.com"
@app.route("/preview")
def preview():
doc_id = int(request.args.get("doc_id", "0"))
resp = requests.get(f"{API_BASE}/docs/{doc_id}", timeout=5)
return resp.text
Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-PY-007, the fixed one does not.