13 · Server-Side Request Forgery (SSRF)

# Gemfile: gem "ssrf_filter"
def import_avatar(url)
  uri = URI.parse(url)
  raise ArgumentError, "http(s) only" unless %w[http https].include?(uri.scheme)
  response = SsrfFilter.get(uri, max_redirects: 0)   # resolves, blocks private IPs, pins IP
  raise "not an image" unless response["content-type"].to_s.start_with?("image/")
  avatar.attach(io: StringIO.new(response.body), filename: "avatar")
rescue SsrfFilter::Error, URI::InvalidURIError
  errors.add(:avatar_url, "can't be fetched")         # generic message, no body echo
end

avatar.attach(io: URI.open(params[:avatar_url]), filename: "a")   # SSRF

// Node: request-filtering-agent blocks private IPs after DNS resolution.
// It needs an agent-aware client (node-fetch, axios, got): Node's built-in fetch ignores `agent`.
import fetch from "node-fetch";
import { useAgent } from "request-filtering-agent";
const res = await fetch(url, { agent: useAgent(url), redirect: "manual" });
await fetch(req.body.url);    // SSRF