サーバーサイドリクエストフォージェリ（SSRF）

RestTemplate restTemplate = new RestTemplate();
String url = request.getParameter("url");
String result = restTemplate.getForObject(url, String.class);

import java.io.IOException;
import java.io.InputStream;
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.nio.charset.StandardCharsets;
import java.time.Duration;
import java.util.Map;
import javax.servlet.http.HttpServletRequest;

public final class SafeEndpointClient {
    private static final Map<String, URI> ENDPOINTS = Map.of(
            "profile", URI.create("https://trusted.com/api/profile"),
            "status", URI.create("https://example.com/api/status"));

    private static final HttpClient CLIENT = HttpClient.newBuilder()
            .connectTimeout(Duration.ofSeconds(3))
            .followRedirects(HttpClient.Redirect.NEVER)
            .build();

    public String fetch(HttpServletRequest request) throws IOException, InterruptedException {
        URI target = ENDPOINTS.get(request.getParameter("endpoint"));
        if (target == null) {
            throw new IllegalArgumentException("Unknown endpoint");
        }

        HttpRequest outbound = HttpRequest.newBuilder(target)
                .timeout(Duration.ofSeconds(5))
                .GET()
                .build();
        HttpResponse<InputStream> response =
                CLIENT.send(outbound, HttpResponse.BodyHandlers.ofInputStream());
        if (response.statusCode() >= 300 && response.statusCode() < 400) {
            response.body().close();
            throw new IOException("Redirects are not allowed");
        }

        try (InputStream body = response.body()) {
            byte[] data = body.readNBytes(1024 * 1024 + 1);
            if (data.length > 1024 * 1024) {
                throw new IOException("Response is too large");
            }
            return new String(data, StandardCharsets.UTF_8);
        }
    }
}