Zennoxa Shield
Rules / Ruby
SHIELD-RUBY-014

SSRF via open-uri or Net::HTTP with variable URL

highRubyCWE-918CVSS 8.6

What it detects

Opening a URL built from user input allows server-side request forgery to internal services.

How to fix

Validate the URL against an allowlist of hosts and schemes before fetching.

Vulnerable — Shield flags thiswebhook_preview_controller.rb
require "open-uri"

class WebhookPreviewController < ApplicationController
  def show
    render plain: URI.open(params[:url]).read
  end
end
Fixed — scans cleanwebhook_preview_controller.rb
require "open-uri"

class WebhookPreviewController < ApplicationController
  ALLOWED_HOSTS = %w[hooks.example.com status.example.com].freeze

  def show
    uri = URI.parse(params[:url])
    return head :forbidden unless uri.is_a?(URI::HTTPS) && ALLOWED_HOSTS.include?(uri.host)
    render plain: uri.open.read
  end
end

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-RUBY-014, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-RUBY-014: SSRF via open-uri or Net::HTTP with variable URL — Zennoxa Shield