All rules →
Rules / Ruby
SHIELD-RUBY-014

SSRF via open-uri or Net::HTTP with variable URL

highRubyCWE-918CVSS 8.6

What it detects

Opening a URL built from user input allows server-side request forgery to internal services.

How to fix

Validate the URL against an allowlist of hosts and schemes before fetching.

Scan your repo freeFull documentation
Back to all rules
SHIELD-RUBY-014: SSRF via open-uri or Net::HTTP with variable URL — Zennoxa Shield