CWE 918 Server-Side Request Forgery (SSRF)

csingh926541 (Community Member) asked a question.

public async Task<byte[]> GetByteArrayAsync(string imagePath, string format, string imageID)

{

var requestUrl = $"{imagePath}&rs:{nameof(format)}={format}&rs:{nameof(imageID)}={imageID}";

return await _client.GetByteArrayAsync(requestUrl);

}

What's wrong here. Not passing any URL. Building URL from parameters.

How can i fix this flaw ?

Topics

Articles

No articles found

Ask the Community

Get answers, share a use case, discuss your favorite features, or get input from the community.

CWE 918 Server-Side Request Forgery (SSRF)