ARathod022276 (Community Member) asked a question.
Veracode SSRF Flag for http.NewRequestWithContext: Mitigating Risk in My Go Application
I'm working on a Go application where I'm using
http.NewRequestWithContext
to make outgoing requests. During a recent Veracode scan, I received an SSRF (Server-Side Request Forgery) flag for the following line:
Go
req, err := http.NewRequestWithContext(ctx, method, url, payload)
Veracode seems to be concerned about the potential for user-controlled input being used in the
url
variable, leading to an attacker crafting a malicious URL that could be executed by my application.
My question is:
- What specific aspects of this line are triggering the Veracode flag? Is it the use of
- http.NewRequestWithContext
- itself, or is it something specific to my implementation?
- What mitigation strategies can I implement to address this SSRF vulnerability? I've considered methods like URL validation,Url sanitization and whitelisting, but I'm facing same issue also in url we are appending the token query parameter in last before making http call further.
- Are there any Veracode-specific considerations or best practices I should be aware of when addressing SSRF vulnerabilities in my Go application?
.png){kind=logo}
Hello Ashwini,
I would recommend you contact our technical support team. Here's how you can log a case:
1. Navigate to the upper right corner of any page in the Community, and click on your user avatar.
2. Select Contact Support from the drop-down menu.Open a case with Support, and provide the steps you are taking to receive that error to better help assist the engineer.
Regards,
Veracode Inc.
With this issue, I would recommend opening a support ticket. You can open a support ticket within the Community. Simply click on your profile on the top right side of the screen and select "Contact Support". Or click on the link below.https://community.veracode.com/s/contact-support