CWE-918 (SSRF) - Java - False Positive Justification

**Description of the false positive**

CWE-918 (SSRF) finding is triggered when input parameters are eventually appended to a URL used to make outbound calls to external systems in the source code.

In the implementation below, although the base URL is sourced from the Spring Boot configuration file (**application.properties**), and input parameter (a String) is validated using a regular expression to enforce a specific length and restrict it to alphanumeric characters. Still CodeQL flag as SSRF vunerbility

Please refer to the code snippet below for reference:

**Code samples or links to source code**

**Controller(source)**

```
@RequestMapping(path = "{inputKey:^[a-zA-Z0-9]{8}$|^[a-zA-Z0-9]{10}$}", method = RequestMethod.GET, produces = MediaType.APPLICATION_JSON_VALUE)
@ApiResponses({ @ApiResponse(responseCode = "404", description = "Resource Not Found"),
@ApiResponse(responseCode = "200", description = "OK") })
public ResourceResponse getURLsByIdentifier(
@Parameter(description = "Enter inputKey.", name = "inputKey", required = true) @PathVariable("inputKey") String inputKey) {

### Source inputKey
return resourceService.getResourceUrls(sanitizeAlphanumeric(inputKey));
}
```

```
private String sanitizeAlphanumeric(String input) {
if (input == null) return "";
return input.replaceAll("[^a-zA-Z0-9]", "");
}

```

**Service Layer (Sink)**

```
//validated URL is being formed
URI configURI = UriComponentsBuilder.
fromUriString(baseUrl) //baseURl is pickup from Spring config using @Value annotation
.path(inputKey) // pased from controller
.queryParam("config", "true")
.build()
.toUri();

HttpEntity entity = new HttpEntity<>(getHeaders());

### Sink configURI
ResponseEntity> response = restTemplate.exchange(configURI, HttpMethod.GET, entity,
new ParameterizedTypeReference<>() {}); // Vunerbility reported here

//have implemented a URL validation mechanism by maintaining a map of all allowed base URLs and verifying
// whether the constructed configURI starts with one of the expected base URLs. However, this approach also did not help resolve the issue.
```

Review the controller's regex validation, the application.properties base URL, and the service-layer restTemplate.exchange sink. Compare this reported flow with CodeQL's Java SSRF analysis; no repository file, query, or test is named, so the expected fix cannot be scoped from this issue alone.

由索引模型根據 Issue 內容生成。