Veracode Findings - CWE 918 Server-Side Request Forgery (SSRF)

Description: The web server receives a URL or similar request from an upstream
component and retrieves the contents of this URL, but it does not
sufficiently ensure that the request is being sent to the expected
destination.

Affected file - com/adobe/cq/wcm/core/components/internal/services/embed/OEmbedClientImpl.java

HttpResponse response = httpClient.execute(new HttpGet(url));

Start by reading com/adobe/cq/wcm/core/components/internal/services/embed/OEmbedClientImpl.java around HttpClient.execute(new HttpGet(url)) and trace how the URL is supplied. Establish how the request can be restricted to expected destinations, then verify that unintended destinations are rejected and add regression coverage if a suitable test location exists.

Written by the indexing model from the issue text.