[Bug]: POST出现服务器端请求伪造漏洞,位置:HEADER

[PhuketIsland]

Preflight Checklist

• I agree to follow the Code of Conduct that this project adheres to.
• I have searched the issue tracker for an issue that matches the one I want to file, without success.
• I am not looking for support or already pursued the available support channels without success.

Version

1.12.0

Installation Type

Official Kubernetes

Service Name

DongTai-Web

Describe the details of the bug and the steps to reproduce it

根据调用链显示x-forwarded-for参数存在ssrf的注入点，我将洞态上的请求复制到burp上重新发从，发现将x-forwarded-for这个参数删除之后仍然可以得到响应结果，这个是不是误报？

Additional Information

No response

Logs

No response

[lostsnow]

Could you provide the complete method pool information? It can be found from the field "method_pool" in the table "iast_agent_method_pool" of the database. Please remember to obfuscate any sensitive information.

[PhuketIsland]

iast_agent_method_pool.txt
@lostsnow 这些是我查出来的相关数据

[lostsnow]

What is the JDK version for this project? method StringConcatHelper.prepend(int,byte[],byte,java.lang.String) causes a widening of the taint propagation process, here we need to investigate whether we can accurately calculate the actual position of the taint in the return value of the method , if it is possible to do so, we can prevent false positives

[PhuketIsland]

已经确定了是误报吗？
@lostsnow 这是JDK版本