{"record":{"id":"03aff5105b30113a","repo":"apache/shenyu","slug":"only-http-and-https-protocols-are-allowed","errorCode":null,"errorMessage":"Only HTTP and HTTPS protocols are allowed","messagePattern":"Only HTTP and HTTPS protocols are allowed","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"shenyu-admin/src/main/java/org/apache/shenyu/admin/utils/UrlSecurityUtils.java","lineNumber":64,"sourceCode":"     *\n     * @param url the URL to validate\n     * @throws IllegalArgumentException if the URL is not safe for external requests\n     */\n    public static void validateUrlForSSRF(final String url) {\n        if (Objects.isNull(url) || url.trim().isEmpty()) {\n            throw new IllegalArgumentException(\"URL cannot be empty\");\n        }\n\n        HttpUrl parsedUrl = HttpUrl.parse(url);\n        if (Objects.isNull(parsedUrl)) {\n            throw new IllegalArgumentException(\"Invalid URL format\");\n        }\n\n        String protocol = parsedUrl.scheme();\n\n        // Only allow HTTP and HTTPS protocols\n        if (!HTTP_PROTOCOL.equals(protocol) && !HTTPS_PROTOCOL.equals(protocol)) {\n            throw new IllegalArgumentException(\"Only HTTP and HTTPS protocols are allowed\");\n        }\n\n        // Validate host for SSRF protection using the same URL parser as request execution.\n        validateHostForSSRF(parsedUrl.host(), parsedUrl.port());\n    }\n\n    /**\n     * Validate host to prevent SSRF attacks.\n     *\n     * @param host the host to validate\n     * @param port the port to validate\n     * @throws IllegalArgumentException if the host is not allowed\n     */\n    public static void validateHostForSSRF(final String host, final int port) {\n        if (Objects.isNull(host) || host.trim().isEmpty()) {\n            throw new IllegalArgumentException(\"Host cannot be empty\");\n        }\n","sourceCodeStart":46,"sourceCodeEnd":82,"githubUrl":"https://github.com/apache/shenyu/blob/567142e07261b3e615ae8850b30f4421f455cc5d/shenyu-admin/src/main/java/org/apache/shenyu/admin/utils/UrlSecurityUtils.java#L46-L82","documentation":"As part of SSRF protection, validateUrlForSSRF restricts the parsed URL's scheme to HTTP or HTTPS and throws IllegalArgumentException \"Only HTTP and HTTPS protocols are allowed\" for anything else. This blocks file://, ftp://, gopher://, data:, etc., which are common SSRF exploitation vectors.","triggerScenarios":"Calling validateUrlForSSRF with URLs like 'file:///etc/passwd', 'ftp://host/file', 'gopher://...', or 'jdbc:...' — any scheme other than http/https.","commonSituations":"Attack payloads attempting to read local files or reach internal services via alternative protocols; misconfiguration where a user pastes a non-HTTP service URL (e.g. an FTP download) into a webhook/health-check field.","solutions":["Use only http:// or https:// URLs for targets admin fetches.","Move files to a location served over HTTP(S) if the intent was to fetch local content via URL.","Do not bypass the validation; if another protocol is genuinely needed, use a dedicated, reviewed code path instead of the SSRF-guarded HTTP client.","Catch IllegalArgumentException and log the rejected scheme for security auditing."],"exampleFix":"// before\nvalidateUrlForSSRF(\"file:///etc/shenyu/config.yaml\");\n// after\nvalidateUrlForSSRF(\"https://backend.example.com/config\");","handlingStrategy":"validation","validationCode":"HttpUrl parsed = HttpUrl.parse(url);\nString scheme = parsed != null ? parsed.scheme() : null;\nif (!\"http\".equals(scheme) && !\"https\".equals(scheme)) {\n    throw new IllegalArgumentException(\"Only http/https targets are supported: \" + scheme);\n}","typeGuard":"boolean isHttpScheme(String s) {\n    HttpUrl u = s == null ? null : HttpUrl.parse(s.trim());\n    return u != null && (\"http\".equals(u.scheme()) || \"https\".equals(u.scheme()));\n}","tryCatchPattern":"try {\n    UrlSecurityUtils.validateUrlForSSRF(url);\n} catch (IllegalArgumentException e) {\n    log.warn(\"Blocked non-HTTP(S) target (possible SSRF attempt): {}\", url);\n    return ResponseEntity.badRequest().body(\"Only http and https URLs are allowed\");\n}","preventionTips":["Treat attempts to submit file://, gopher://, ftp:// URLs as suspicious and log them.","Restrict UI inputs to http/https URL pickers/validators.","Never fetch arbitrary user-supplied URLs outside the SSRF-validated path.","Keep the validation in place — do not special-case non-HTTP protocols."],"tags":["ssrf","url","security","protocol"],"backgroundTag":"invalid-url","analyzedSha":"567142e07261b3e615ae8850b30f4421f455cc5d","analyzedAt":"2026-09-12T10:08:21.293Z","contentChangedAt":"2026-09-12T10:08:21.293Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}