ssrf.yml

rules:
- id: SSRF
  message: |
    Generic SSRF Java
  metadata:
    cwe: "CWE-X"
    owasp: "A1: Injection"
  severity: ERROR
  patterns:
  - pattern-either:
    - pattern: | #execute Directly
        $RETURN $METHOD(...,String $VAR, ...) {
          ...
          URL $URL = new URL($VAR);
          ...
        }
    - pattern: $URL = new URL($VAR);
  - pattern-not: $URL = new URL("...");
    
  languages:
  - java