All rules →
Rules / JavaScript / TypeScript
SHIELD-JS-016

Server-Side Request Forgery (SSRF) via user-controlled URL

highJavaScript / TypeScriptCWE-918CVSS 8.6

What it detects

Fetching URLs from user input without validation can allow SSRF attacks.

How to fix

Validate and allowlist URLs before making server-side HTTP requests.

Scan your repo freeFull documentation
Back to all rules
SHIELD-JS-016: Server-Side Request Forgery (SSRF) via user-controlled URL — Zennoxa Shield