title: Server-Side Request Forgery Fortify Fix
body: <p>I'm trying to call a webservice. This webservice call depends on the user input as the URL.</p>
  
  <p>The URL looks like follows:</p>
  
  <pre><code>https://someurl.com/somefunction/{userinput}
  </code></pre>
  
  <p>And my function looks like this</p>
  
  <pre><code>public async Task&lt;Data&gt; GetData(string input)
  {
      try
      {
          Address = BaseAddress; // https://someurl.com/somefunction/{userinput}
          Address = Address.Replace("{userinput}", input);
          ....
          WebService ws = await base.GetData(httpClient, serverIPaddress);
          ....
      }
  }
  </code></pre>
  
  <p>And I get the security error from Fortify</p>
  
  <blockquote>
    <p>Server-Side Request Forgery (Input Validation and Representation, Data
    Flow) </p>
    
    <p>The function GetAsync() on line 122 initiates a network connection to
    a third-party system using user-controlled data for resource URI. An
    attacker may leverage this vulnerability to send a request on behalf
    of the application server since the request will originate from the
    application server's internal IP address.</p>
  </blockquote>
  
  <p>Here are the recommendations:</p>
  
  <p>Recommendations:</p>
  
  <blockquote>
    <p>Do not establish network connections based on user-controlled data and
    ensure that the request is being sent to the expected destination. If
    user data is necessary to build the destination URI, use  a level of
    indirection: create a list of legitimate resource names that a user is
    allowed to specify, and only allow the user to select from the list.
    With this approach the input provided by the user is never used
    directly to specify the resource name.</p>
    
    <p>In some situations this approach is impractical because the set of
    legitimate resource names is too large or too hard to keep track of.
    Programmers often resort to blacklisting in these situations.
    Blacklisting selectively rejects or escapes potentially dangerous
    characters before using the input. However, any such list of unsafe
    characters is likely to be incomplete and will almost certainly become
    out of date. A better approach is to create a whitelist of characters
    that are allowed to appear in the resource name and accept input
    composed exclusively of characters in the approved set.</p>
    
    <p>Also, if required, make sure that the user input is only used to
    specify a resource on the target system but that the URI scheme, host,
    and port is controlled by the application. This way the damage that an
    attacker is able to do will be significantly reduced.</p>
  </blockquote>
  
  <p>But the thing is that I really need to change <code>{userinput}</code> based on the supplied data from user. <code>{userinput}</code> will be a string with a certain maximum length.
  How to resolve this issue?</p>