← All recipes
Moderne licensed

Remediate server-side request forgery (SSRF)

Recipe IDorg.openrewrite.java.security.FixCwe918Artifactorg.openrewrite.recipe:rewrite-java-security

Inserts a guard that validates URLs constructed from user-controlled input do not resolve to internal, reserved, or otherwise unsafe network addresses, blocking server-side request forgery (SSRF) attacks. The block list covers IPv4 and IPv6, including IPv4-mapped IPv6 (::ffff:0:0/96), IPv6 ULA (fc00::/7), NAT64 (64:ff9b::/96), 6to4 (2002::/16), and Teredo (2001::/32) — all of which embed or translate to addresses that would otherwise bypass a naïve isSiteLocalAddress / isLoopbackAddress check. The guard does not by itself prevent DNS rebinding. URL.openConnection() re-resolves the host at connect time, so a rapidly shifting authoritative DNS response can answer with a public IP during validation and an internal IP at connect time. Closing this time-of-check / time-of-use window requires binding the TCP connection to the validated IP literal — typically via a hardened HTTP client with a custom DNS resolver (HttpClient.Builder, Apache HttpClient's DnsResolver, OkHttp's Dns, etc.) — and is HTTP-client-specific, so it is out of scope for this recipe. The block list reflects IANA special-use registries at the time of this recipe's release and is not, and cannot be, permanently complete. New special-use ranges are assigned periodically — 3fff::/20 was added as IPv6 documentation space in 2024 (RFC 9637), for example — so the list will need ongoing maintenance to keep pace with the IANA IPv4 and IPv6 Special-Purpose Address Registries.

Single recipeCWE-918Proprietary

Add to your build

Get a download tokenThis recipe is Moderne licensed, so the token must belong to a Moderne customer. It replaces YOUR_DOWNLOAD_TOKEN below.

~/.gradle/gradle.properties

codeGenomeUsername=you@example.com
codeGenomeToken=YOUR_DOWNLOAD_TOKEN

build.gradle.kts

plugins {
    id("org.openrewrite.rewrite") version("latest.release")
}

rewrite {
    activeRecipe("org.openrewrite.java.security.FixCwe918")
}

repositories {
    mavenCentral()
    maven {
        url = uri("https://artifacts.codegenomeproject.org/maven")
        credentials {
            username = providers.gradleProperty("codeGenomeUsername").get()
            password = providers.gradleProperty("codeGenomeToken").get()
        }
    }
}

dependencies {
    rewrite("org.openrewrite.recipe:rewrite-java-security:3.41.0")
}

Then run

./gradlew rewriteRun

Usage

This recipe has no required configuration options. You’ll need the Moderne CLI configured before running the command below.

mod run . --recipe org.openrewrite.java.security.FixCwe918

If the recipe isn’t available locally, install it with:

mod config recipes jar install org.openrewrite.recipe:rewrite-java-security:RELEASE

Data tables

Structured output this recipe can produce.

  • Source files that had resultsSource files that were modified by the recipe run.org.openrewrite.table.SourcesFileResults
  • Source files that had search resultsSearch results that were found during the recipe run.org.openrewrite.table.SearchResults
  • Source files that errored on a recipeThe details of all errors produced by a recipe run.org.openrewrite.table.SourcesFileErrors
  • Recipe performanceStatistics used in analyzing the performance of recipes.org.openrewrite.table.RecipeRunStats