I'm building a java server that sends APIs to other service servers.

​Since I have to run this server on different VM Server, I made application.yml that contains partial url data.

spring:

config:

activate:

on-profile:

- prod

elastic:

url: http://10.132.155.111:9200

index-name: my_idx

​

Using this application.yml, my spring boot server gets url path and index name

@Value("${elastic.url}")

private String elasticUrl;

​

@Value("${elastic.index-name}")

private String indexName;

​

But during Veracode static scan I'm getting CWE 918 flaw.

I even added some validation to the code but it keeps failing to pass CWE-918 flaw.

The code I used to send postrequest is like below.

​

Set<String> allowedURL = Set.of(

"http://10.135.145.155/elastic/my_idx/_search", // local

"http://10.132.155.111:9200/my_idx/_search", // test-windows

"http://localhost:9200/my_idx/_search" // test-linux

);

String baseUrl = elasticUrl;

String apiPath = "/" + indexName + "/_search";

​

UriComponents uriComponents = UriComponentsBuilder.fromHttpUrl(elasticUrl)

.path(apiPath)

.build();

​

String requestURL = uriComponents.toString();

if(!allowedURL.contains(requestURL)){

throw new IllegalArgumentException("Invalid Elastic URL Request");

}

​HttpClient client = HttpClientBuilder.create().build();

HttpPost postRequest = new HttpPost(requestURL);

//Params input below

postRequest.setEntity(new StringEntity(params.toString(), "UTF-8"));

HttpResponse response = client.execute(postRequest);

The detailed report is directing the code below.

"HttpResponse response = client.execute(postRequest);"

How can I resolve this flaw?