SSRF（服务端请求伪造）#

@RestController
public class ImageController {
    
    @Autowired
    private RestTemplate restTemplate;
    
    /**
     * 危险：从用户输入获取 URL 并请求
     */
    @GetMapping("/fetch/image")
    public ResponseEntity<byte[]> fetchImage(@RequestParam String imageUrl) {
        // 直接使用用户输入的 URL
        return restTemplate.getForEntity(imageUrl, byte[].class);
        // 攻击者可以传入：http://localhost:22 或 http://169.254.169.254/latest/meta-data/
    }
}

@RestController
public class WebhookController {
    
    /**
     * Webhook 回调功能
     */
    @PostMapping("/webhook/test")
    public ResponseEntity<String> testWebhook(@RequestParam String callbackUrl) {
        HttpHeaders headers = new HttpHeaders();
        headers.setContentType(MediaType.APPLICATION_JSON);
        
        String payload = "{\"test\": \"data\"}";
        
        // 攻击者可以指定回调地址
        HttpEntity<String> request = new HttpEntity<>(payload, headers);
        
        // 如果回调地址是内网服务...
        return restTemplate.postForEntity(callbackUrl, request, String.class);
    }
}

@Service
public class SafeUrlValidator {
    
    private static final Set<String> ALLOWED_PROTOCOLS = Set.of("http", "https");
    private static final Set<String> BLOCKED_HOSTS = Set.of(
        "localhost",
        "127.0.0.1",
        "0.0.0.0",
        "169.254.169.254",  // AWS 元数据
        "metadata.google.internal"  // GCP 元数据
    );
    
    public boolean isValidUrl(String urlString) {
        try {
            URL url = new URL(urlString);
            
            // 检查协议
            if (!ALLOWED_PROTOCOLS.contains(url.getProtocol().toLowerCase())) {
                return false;
            }
            
            // 检查主机
            String host = url.getHost().toLowerCase();
            if (isBlockedHost(host)) {
                return false;
            }
            
            // 检查是否是内网 IP
            if (isPrivateIp(url.getHost())) {
                return false;
            }
            
            return true;
        } catch (MalformedURLException e) {
            return false;
        }
    }
    
    private boolean isBlockedHost(String host) {
        for (String blocked : BLOCKED_HOSTS) {
            if (host.equals(blocked) || host.endsWith("." + blocked)) {
                return true;
            }
        }
        return false;
    }
    
    private boolean isPrivateIp(String host) {
        try {
            InetAddress address = InetAddress.getByName(host);
            return address.isSiteLocalAddress() || 
                   address.isLoopbackAddress() ||
                   address.isLinkLocalAddress();
        } catch (UnknownHostException e) {
            return true; // 无法解析的视为不安全
        }
    }
}

@Service
public class WhitelistUrlValidator {
    
    // 配置允许的域名白名单
    private final Set<String> allowedDomains;
    
    public WhitelistUrlValidator() {
        this.allowedDomains = Set.of(
            "cdn.example.com",
            "images.example.com",
            "api.example.com"
        );
    }
    
    public boolean isAllowed(String urlString) {
        try {
            URL url = new URL(urlString);
            String host = url.getHost();
            
            // 检查域名是否在白名单中
            // 支持通配符
            return allowedDomains.stream()
                .anyMatch(pattern -> matchesPattern(host, pattern));
        } catch (MalformedURLException e) {
            return false;
        }
    }
    
    private boolean matchesPattern(String host, String pattern) {
        if (pattern.startsWith("*.")) {
            String suffix = pattern.substring(2);
            return host.equals(suffix) || host.endsWith("." + suffix);
        }
        return host.equals(pattern);
    }
}

@Configuration
public class SecurityConfig {
    
    @Bean
    public RestTemplate safeRestTemplate() {
        SimpleClientHttpRequestFactory factory = new SimpleClientHttpRequestFactory();
        factory.setConnectTimeout(Duration.ofSeconds(5));
        factory.setReadTimeout(Duration.ofSeconds(10));
        
        return new RestTemplate(new CustomRestTemplate(factory));
    }
    
    static class CustomRestTemplate extends RestTemplate {
        private final Set<String> blockedHosts = Set.of(
            "169.254.169.254",
            "metadata.google.internal",
            "100.100.100.200"
        );
        
        @Override
        protected ClientHttpRequest createRequest(
                URI uri, HttpMethod method) throws URIException {
            
            String host = uri.getHost();
            
            // 阻止内网和云元数据地址
            if (isBlockedHost(host)) {
                throw new RestClientException("Blocked host: " + host);
            }
            
            // 阻止非 HTTP(S) 协议
            String scheme = uri.getScheme();
            if (!"http".equalsIgnoreCase(scheme) && 
                !"https".equalsIgnoreCase(scheme)) {
                throw new RestClientException("Blocked protocol: " + scheme);
            }
            
            return super.createRequest(uri, method);
        }
        
        private boolean isBlockedHost(String host) {
            if (host == null) return true;
            
            host = host.toLowerCase();
            if (blockedHosts.contains(host)) return true;
            
            try {
                InetAddress addr = InetAddress.getByName(host);
                // 阻止私有地址
                if (addr.isSiteLocalAddress() || 
                    addr.isLoopbackAddress() ||
                    addr.isLinkLocalAddress()) {
                    return true;
                }
            } catch (UnknownHostException e) {
                return true;
            }
            
            return false;
        }
    }
}

public class SafeHttpClient {
    
    private final OkHttpClient client;
    
    public SafeHttpClient() {
        this.client = new OkHttpClient.Builder()
            // 只允许 HTTP/HTTPS
            .protocols(List.of(Protocol.HTTP_1_1, Protocol.HTTP_2))
            // 设置超时
            .connectTimeout(5, TimeUnit.SECONDS)
            .readTimeout(10, TimeUnit.SECONDS)
            // 添加拦截器
            .addInterceptor(this::validateRequest)
            .build();
    }
    
    private Response validateRequest(Interceptor.Chain chain) throws IOException {
        Request request = chain.request();
        String url = request.url().toString();
        
        // 检查 URL 是否安全
        if (!isUrlSafe(url)) {
            throw new IOException("Blocked URL: " + url);
        }
        
        return chain.proceed(request);
    }
    
    private boolean isUrlSafe(String url) {
        try {
            URL parsedUrl = new URL(url);
            
            // 只允许 HTTP/HTTPS
            String protocol = parsedUrl.getProtocol().toLowerCase();
            if (!protocol.equals("http") && !protocol.equals("https")) {
                return false;
            }
            
            // 阻止常见 SSRF 目标
            String host = parsedUrl.getHost().toLowerCase();
            if (host.contains("169.254") || 
                host.contains("metadata") ||
                host.equals("localhost") ||
                host.equals("0.0.0.0")) {
                return false;
            }
            
            // 检查是否是内网 IP
            InetAddress address = InetAddress.getByName(host);
            if (address.isSiteLocalAddress() || 
                address.isLoopbackAddress()) {
                return false;
            }
            
            return true;
        } catch (Exception e) {
            return false;
        }
    }
}