@sun-asterisk/sunlint 1.3.40 → 1.3.41

package/skill-assets/sunlint-code-quality/rules/go/S058-ssrf-protection.md

@@ -0,0 +1,70 @@
+---
+title: Protect Against SSRF Attacks
+impact: MEDIUM
+impactDescription: prevents internal network access from user input
+tags: ssrf, url, network, internal, security
+---
+
+## Protect Against SSRF Attacks
+
+SSRF allows attackers to make requests from your server to internal services, local files, or cloud metadata endpoints.
+
+**Incorrect (accepting user URLs without validation):**
+
+```go
+func Handler(w http.ResponseWriter, r *http.Request) {
+    url := r.URL.Query().Get("url")
+    resp, _ := http.Get(url) // Attacker controls URL!
+    io.Copy(w, resp.Body)
+}
+// Attacker: ?url=http://169.254.169.254/latest/meta-data/
+```
+
+**Correct (URL validation and IP blocking):**
+
+```go
+import (
+    "net"
+    "net/url"
+)
+
+var allowedHosts = []string{"api.example.com", "cdn.example.com"}
+
+func SafeFetch(userURL string) (*http.Response, error) {
+    parsed, err := url.Parse(userURL)
+    if err != nil {
+        return nil, err
+    }
+
+    // 1. Protocol whitelist
+    if parsed.Scheme != "http" && parsed.Scheme != "https" {
+        return nil, errors.New("protocol not allowed")
+    }
+
+    // 2. Host whitelist
+    isAllowed := false
+    for _, h := range allowedHosts {
+        if parsed.Hostname() == h {
+            isAllowed = true
+            break
+        }
+    }
+    
+    // 3. Resolve IP and block internal ranges
+    ips, _ := net.LookupIP(parsed.Hostname())
+    for _, ip := range ips {
+        if ip.IsLoopback() || ip.IsPrivate() || ip.IsUnspecified() {
+            return nil, errors.New("internal IP blocked")
+        }
+    }
+
+    client := &http.Client{
+        CheckRedirect: func(req *http.Request, via []*http.Request) error {
+            return http.ErrUseLastResponse // Disable redirects
+        },
+    }
+    return client.Get(userURL)
+}
+```
+
+**Tools:** `net/url`, `net.LookupIP`, `gosec` (G107)