Amazon Q
Detector Library
Ruby detectors (29/29)
SQL InjectionDivide by ZeroSensitive HTTP ActionInsufficient Protected CredentialsSensitive Information LeakCross-Site Request Forgery (CSRF)Untrusted DeserializationLog InjectionXML External EntityPath InjectionDeprecated Get ConfigurationHttp to File AccessInsufficient Key SizeCode InjectionOS Command InjectionInsecure CookieResource leakCross Site Scripting (XSS)Untrusted OpenModel Attr AccessibleServer Side Request ForgeryImproper Input ValidationStack Trace ExposureOpen RedirectImproper Certificate Validationsend_file InjectionUnsafe File PermissionsInsecure CryptographyTainted Format
Server Side Request Forgery High
User-controlled input is being used to construct URLs, which may lead to unauthorized requests to internal resources.
Detector ID
ruby/server-side-request-forgery@v1.0
Category
Common Weakness Enumeration (CWE) 
Noncompliant example
1require 'net/http'
2
3def server_side_request_forgery_noncompliant
4 url = params[:url]
5 # Noncompliant: url is passing through `HTTP.get()`.
6 Net::HTTP.get(url, "/index.html")
7endCompliant example
1def server_side_request_forgery_compliant
2 url = params[:url]
3 # Compliant: url is not passing through `HTTP.get()`.
4 Net::HTTP.get("example.com", "/index.html")
5end