Sandboxed URL creation to prevent SSRF attacks #23

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Open

pixeebot wants to merge 1 commit into master from pixeebot/drip-2025-06-22-pixee-java/sandbox-url-creation

pixeebot bot commented Jun 22, 2025

This change sandboxes the creation of java.net.URL objects so they will be more resistant to Server-Side Request Forgery (SSRF) attacks.

Most of the time when you create a URL, you're intending to reference an HTTP endpoint, like an internal microservice. However, URLs can point to local file system files, a Gopher stream in your local network, a JAR file on a remote Internet site, and all kinds of other unexpected and undesirable stuff. When the URL values are influenced by attackers, they can trick your application into fetching internal resources, running malicious code, or otherwise harming the system. Consider the following code:

String url = userInput.getServiceAddress();
return IOUtils.toString(new URL(url).openConnection());

In this case, an attacker could supply a value like jar:file:/path/to/appserver/lib.jar and attempt to read the contents of your application's code.

Our changes introduce sandboxing around URL creation that force the developers to specify some boundaries on the types of URLs they expect to create:

+ import io.github.pixee.security.Urls;
+ import io.github.pixee.security.HostValidator;
  ...
  String url = userInput.getServiceAddress();
- URL u = new URL(url);
+ URL u = Urls.create(url, Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS);
  InputStream is = u.openConnection();

This change alone reduces attack surface significantly, but can be enhanced to create even more security by specifying some controls around the hosts we expect to connect with:

+ import io.github.pixee.security.Urls;
+ import io.github.pixee.security.HostValidator;
  ...
  HostValidator allowsOnlyGoodDotCom = HostValidator.fromAllowedHostPattern(Pattern.compile("good\\.com"));
  URL u = Urls.create(url, Urls.HTTP_PROTOCOLS, allowsOnlyGoodDotCom);

Note: Beware temptation to write some validation on your own. Parsing URLs is difficult and differences between parsers in validation and execution will certainly lead to exploits as attackers have repeatedly proven.

More reading

I have additional improvements ready for this repo! If you want to see them, leave the comment:

@pixeebot next

... and I will open a new PR right away!

🧚🤖 Powered by Pixeebot

Feedback | Community | Docs | Codemod ID: pixee:java/sandbox-url-creation


          Sandboxed URL creation to prevent SSRF attacks

813e23a

pixeebot bot commented

View reviewed changes

druid-handler/pom.xml

@@ @@ -312,6 +312,10 @@ @@
                     <version>${log4j2.version}</version>
                     <scope>test</scope>
                   </dependency>
+                  <dependency>

Author

pixeebot bot Jun 22, 2025

This library holds security tools for protecting Java API calls.

License: MIT ✅ | Open source ✅ | More facts

pixeebot bot commented

View reviewed changes

pom.xml

@@ @@ -1432,6 +1433,18 @@ @@
                       <version>${postgres.version}</version>
                       <scope>runtime</scope>
                     </dependency>
+                    <dependency>

Author

pixeebot bot Jun 22, 2025

This library holds security tools for protecting Java API calls.

License: MIT ✅ | Open source ✅ | More facts

pixeebot bot commented

View reviewed changes

hcatalog/webhcat/svr/pom.xml

@@ @@ -230,6 +230,10 @@ @@
                     <artifactId>junit-vintage-engine</artifactId>
                     <scope>test</scope>
                   </dependency>
+                  <dependency>

Author

pixeebot bot Jun 22, 2025

This library holds security tools for protecting Java API calls.

License: MIT ✅ | Open source ✅ | More facts

pixeebot bot commented

View reviewed changes

pom.xml

+                    <dependency>
+                      <groupId>io.github.pixee</groupId>
+                      <artifactId>java-security-toolkit</artifactId>

Author

pixeebot bot Jun 22, 2025

This library holds security tools for protecting Java API calls.

License: MIT ✅ | Open source ✅ | More facts

pixeebot bot commented

View reviewed changes

itests/hive-unit/pom.xml

@@ @@ -498,6 +498,10 @@ @@
                     <artifactId>postgresql</artifactId>
                     <scope>test</scope>
                   </dependency>
+                  <dependency>

Author

pixeebot bot Jun 22, 2025

This library holds security tools for protecting Java API calls.

License: MIT ✅ | Open source ✅ | More facts

pixeebot bot commented

View reviewed changes

itests/pom.xml

@@ @@ -494,6 +495,12 @@ @@
                       <artifactId>hive-iceberg-handler</artifactId>
                       <version>${project.version}</version>
                     </dependency>
+                    <dependency>

Author

pixeebot bot Jun 22, 2025

This library holds security tools for protecting Java API calls.

License: MIT ✅ | Open source ✅ | More facts

pixeebot bot commented

View reviewed changes

itests/util/pom.xml

@@ @@ -247,6 +247,10 @@ @@
                       </exclusion>
                     </exclusions>
                   </dependency>
+                  <dependency>

Author

pixeebot bot Jun 22, 2025

This library holds security tools for protecting Java API calls.

License: MIT ✅ | Open source ✅ | More facts

pixeebot bot commented

View reviewed changes

itests/pom.xml

+                    <dependency>
+                      <groupId>io.github.pixee</groupId>
+                      <artifactId>java-security-toolkit</artifactId>

Author

pixeebot bot Jun 22, 2025

This library holds security tools for protecting Java API calls.

License: MIT ✅ | Open source ✅ | More facts

pixeebot bot commented

View reviewed changes

jdbc/pom.xml

@@ @@ -133,6 +133,10 @@ @@
                     <artifactId>junit-vintage-engine</artifactId>
                     <scope>test</scope>
                   </dependency>
+                  <dependency>

Author

pixeebot bot Jun 22, 2025

This library holds security tools for protecting Java API calls.

License: MIT ✅ | Open source ✅ | More facts

pixeebot bot commented

View reviewed changes

pom.xml

		<groupId>io.github.pixee</groupId>
		<artifactId>java-security-toolkit</artifactId>

Author

pixeebot bot Jun 22, 2025

This library holds security tools for protecting Java API calls.

License: MIT ✅ | Open source ✅ | More facts

pixeebot bot commented

View reviewed changes

llap-client/pom.xml

@@ @@ -218,6 +218,10 @@ @@
                       </exclusion>
                     </exclusions>
                   </dependency>
+                  <dependency>

Author

pixeebot bot Jun 22, 2025

This library holds security tools for protecting Java API calls.

License: MIT ✅ | Open source ✅ | More facts

pixeebot bot commented

View reviewed changes

pom.xml

		<artifactId>java-security-toolkit</artifactId>

Author

pixeebot bot Jun 22, 2025

This library holds security tools for protecting Java API calls.

License: MIT ✅ | Open source ✅ | More facts

pixeebot bot commented

View reviewed changes

llap-server/pom.xml

@@ @@ -459,6 +459,10 @@ @@
                     <artifactId>hbase-hadoop-compat</artifactId>
                     <scope>provided</scope>
                   </dependency>
+                  <dependency>

Author

pixeebot bot Jun 22, 2025

This library holds security tools for protecting Java API calls.

License: MIT ✅ | Open source ✅ | More facts

pixeebot bot commented

View reviewed changes

pom.xml

Author

pixeebot bot Jun 22, 2025

This library holds security tools for protecting Java API calls.

License: MIT ✅ | Open source ✅ | More facts

pixeebot bot commented

View reviewed changes

ql/pom.xml

@@ @@ -876,6 +876,10 @@ @@
                     <artifactId>RoaringBitmap</artifactId>
                     <version>0.9.22</version>
                   </dependency>
+                  <dependency>

Author

pixeebot bot Jun 22, 2025

This library holds security tools for protecting Java API calls.

License: MIT ✅ | Open source ✅ | More facts

pixeebot bot commented

View reviewed changes

pom.xml

Author

pixeebot bot Jun 22, 2025

This library holds security tools for protecting Java API calls.

License: MIT ✅ | Open source ✅ | More facts

pixeebot bot commented

View reviewed changes

serde/pom.xml

@@ @@ -249,6 +249,10 @@ @@
                     <version>${mockito-core.version}</version>
                     <scope>test</scope>
                   </dependency>
+                  <dependency>

Author

pixeebot bot Jun 22, 2025

This library holds security tools for protecting Java API calls.

License: MIT ✅ | Open source ✅ | More facts

pixeebot bot commented

View reviewed changes

pom.xml

Author

pixeebot bot Jun 22, 2025

This library holds security tools for protecting Java API calls.

License: MIT ✅ | Open source ✅ | More facts

pixeebot bot commented

View reviewed changes

service/pom.xml

@@ @@ -355,6 +355,10 @@ @@
                     <version>${hadoop.version}</version>
                     <scope>test</scope>
                   </dependency>
+                  <dependency>

Author

pixeebot bot Jun 22, 2025

This library holds security tools for protecting Java API calls.

License: MIT ✅ | Open source ✅ | More facts

pixeebot bot commented

View reviewed changes

pom.xml

Author

pixeebot bot Jun 22, 2025

This library holds security tools for protecting Java API calls.

License: MIT ✅ | Open source ✅ | More facts

pixeebot bot commented

View reviewed changes

standalone-metastore/metastore-common/pom.xml

@@ @@ -324,6 +324,10 @@ @@
                     <artifactId>slf4j-simple</artifactId>
                     <scope>test</scope>
                   </dependency>
+                  <dependency>

Author

pixeebot bot Jun 22, 2025

This library holds security tools for protecting Java API calls.

License: MIT ✅ | Open source ✅ | More facts

pixeebot bot commented

View reviewed changes

standalone-metastore/pom.xml

@@ @@ -489,6 +490,12 @@ @@
                       <version>${slf4j.version}</version>
                       <scope>test</scope>
                     </dependency>
+                    <dependency>

Author

pixeebot bot Jun 22, 2025

This library holds security tools for protecting Java API calls.

License: MIT ✅ | Open source ✅ | More facts

pixeebot bot commented

View reviewed changes

standalone-metastore/metastore-server/pom.xml

@@ @@ -417,6 +417,10 @@ @@
                     <classifier>tests</classifier>
                     <scope>test</scope>
                   </dependency>
+                  <dependency>

Author

pixeebot bot Jun 22, 2025

This library holds security tools for protecting Java API calls.

License: MIT ✅ | Open source ✅ | More facts

pixeebot bot commented

View reviewed changes

standalone-metastore/pom.xml

+                    <dependency>
+                      <groupId>io.github.pixee</groupId>
+                      <artifactId>java-security-toolkit</artifactId>

Author

pixeebot bot Jun 22, 2025

This library holds security tools for protecting Java API calls.

License: MIT ✅ | Open source ✅ | More facts

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet