Veracode Findings - CWE 918 Server-Side Request Forgery (SSRF)

adobe / aem-core-wcm-components

Standardized components to build websites with AEM.

https://docs.adobe.com/content/help/en/experience-manager-core-components/using/introduction.html

Apache License 2.0

733 stars 741 forks source link

Veracode Findings - CWE 918 Server-Side Request Forgery (SSRF) #2297

Open niraj-100 opened 2 years ago

niraj-100 commented 2 years ago

Description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Affected file - com/adobe/cq/wcm/core/components/internal/services/embed/OEmbedClientImpl.java

   HttpResponse response = httpClient.execute(new HttpGet(url));

fangw1 commented 1 year ago

did you fixed?