Veracode Findings - CWE 918 Server-Side Request Forgery (SSRF)

Description: The web server receives a URL or similar request from an upstream
component and retrieves the contents of this URL, but it does not
sufficiently ensure that the request is being sent to the expected
destination.

Affected file - com/adobe/cq/wcm/core/components/internal/form/FormHandlerImpl.java

post.setHeader(entry.getKey(), entry.getValue());

Start by reading com/adobe/cq/wcm/core/components/internal/form/FormHandlerImpl.java, especially the post.setHeader(entry.getKey(), entry.getValue()) path and the code that retrieves the submitted URL. Trace how the destination is determined and identify the expected validation boundary. Done means the reported SSRF path is addressed and the relevant security behavior is verified, but the issue does not name a test.

Written by the indexing model from the issue text.