SSRF via connection string / non-fetch sink / DNS rebinding
Part of the AI-generated code risks check · fix arrives as a pull request
What it is
A server-side request reaches a user-influenced destination through something other than a plain fetch — a connection string, a webhook target, a URL passed to an image or PDF renderer — or the target is re-resolved after being validated.
Why it matters
These are the SSRF paths that host allow-lists miss. A DNS name can pass validation and then resolve to 169.254.169.254 on the actual connection, and a database or SMTP URL is a request to an arbitrary host with a protocol that firewalls often permit.
How to fix it
Validate and pin the resolved address, then connect to that address rather than re-resolving the name. Keep egress from application servers on an allow-list at the network layer, so a missed check in code is not the only control.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.