rules:
- id: webservice-ssrf
  patterns:
  - pattern: $WS.url($URL)
  - pattern-either:
    - pattern-inside: |
        class $CLASS (..., $WS: WSClient, ...) {
          ...
        }
    - pattern-inside: |
        def $FUNC(..., $WS: WSClient, ...) = {
          ...
        }
    - pattern-inside: |
        $WS = AhcWSClient(...)
        ...
  - pattern-either:
    - pattern-inside: |
        def $FUNC(..., $URL: $T, ...) = $A {
          ...
        }
    - pattern-inside: |
        def $FUNC(..., $URL: $T, ...) = {
          ...
        }
  message: >-
    A parameter being passed directly into `WSClient` most likely lead to SSRF.
    This could allow an attacker to send data to their own server, potentially exposing sensitive data
    sent with this request.
    They could also probe internal servers or other resources that the server running this code can access.
    Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts hardcode the correct
    host.
  metadata:
    cwe:
    - 'CWE-918: Server-Side Request Forgery (SSRF)'
    owasp:
    - A10:2021 - Server-Side Request Forgery (SSRF)
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
    - https://www.playframework.com/documentation/2.8.x/ScalaWS
    category: security
    technology:
    - scala
    - play
    confidence: LOW
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
  languages: [scala]
  severity: WARNING