Rule Definition
The software does not properly neutralize URLs, host or port that are used in a request execution, allowing attackers to access internal services or to launch attacks from your web server.

Remediation
Do not accept URLs, host and port from users. Use a whitelist of allowed values to build the URL.

Violation Code Sample

app = Flask(__name__)

@app.route("/foo")
def func():
    target = request.args["target"]
    resp = requests.get("https://" + target + ".example.com/data/")

Fixed Code Sample

app = Flask(__name__)

@app.route("/foo")
def func():
    target = request.args["target"]
    subdomain = "europe" if target == "eu" else "www"  # sanitization
    resp = request.get("https://" + subdomain + ".example.com/data/")

https://cwe.mitre.org/data/definitions/918.html https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/ https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html