0

My company uses a security scan tool called Snyk to scan code for security vulnerabilities.

It is complaining about a Server-Side Request Forgery (SSRF) vulnerability.

The details says Unsanitized input from a SOQL statement flows into setendpoint, where it is used as an URL to perform a request. This may result in a Server-Side Request Forgery vulnerability.

Here is what the code looks like:

String endpointWithParams = String.format('{0}/{1}', new String[] { constants.API_URL, String.escapeSingleQuotes(subscriptionId) });
HttpRequest request = new HttpRequest();
request.setHeader('Authorization', 'Bearer ' + accessToken);
request.setHeader('Content-Type', 'application/json');
request.setMethod('DELETE');
request.setEndpoint(endpointWithParams); // <- THIS IS THE LINE TRIGGERING THE VULERABILITY

It is all coming from the variable subscriptionId which is coming from an object returned by a SOQL query. As you see above I tried to wrap the subscriptionId is a call to String.escapeSingleQuotes but no luck.

What am I missing? How do I sanitize the input?

Improve this question

1 Answer 1

Reset to default
0

You should use EncodingUtil.uelEncode instead of String.escapeSingleQuotes when dealing with URLs. Further, it might be the API_URL it's complaining about. Did you also sanitize it?

Improve this answer
2
  • the API_URL is a constant. Would it still need to be sanitized? That seems to replace slashes and colons in the URL too. Would I use urlEncode only for subscriptionId for the entire value going into setEndpoint? The code scan tool does trace all the way back to the value from the object returned by the SOQL query so it doesn't seem like API_URL.
    – James
    May 26 at 23:11
  • @James if it's constant, no. I just didn't want to make any assumptions (e.g. some places use custom metadata types). You use EncodingUtil.urlEncode on the subscriptionId to make sure it can't be hack by, for example, a value being set with something like delete/1234, which would potentially be different than your intent. However, this could also be a false positive--only you know how your data is set and the server reacts. You can document these exceptions if need be.
    – sfdcfox
    May 27 at 4:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .