title: Unable to rectify VeraCode CWE ID 918 - (SSRF) in ASP.NET
body: <p>Long story short, no matter what I try VeraCode continues to flag 8 lines of my code as flaws with CWE 918. This is old code so I'm not sure why it's suddenly being flagged.</p>
  
  <p>Here's an example [offending] method with the flagged line in bold</p>
  
  <pre><code>  public virtual async Task&lt;HttpResponseMessage&gt; Put(string controller = "", Dictionary&lt;string, object&gt; parameters = null, object body = null)
          {
              if (string.IsNullOrWhiteSpace(ApiBaseUrl)) return null;
              HttpResponseMessage response = null;
  
              using (var client = GetHttpClient())
              {
                  client.BaseAddress = new Uri(ApiBaseUrl);
  
                  if (!string.IsNullOrEmpty(Token)) client.DefaultRequestHeaders.Add("Token-Key", Token);
                  if (!string.IsNullOrEmpty(DeviceId)) client.DefaultRequestHeaders.Add("DeviceId", DeviceId);
  
                  var url = GenerateUrl(controller, parameters);
  
                  var requestBody = GeneratedHttpContent(body);
                  if (requestBody == null) requestBody = new StringContent("");
  
                  **response = await client.PutAsync(url, requestBody);**
  
                  await LogError(response);
                  return response;
              }
          }
  </code></pre>
  
  <p>Here's my proposed fix that utilized an extension method to validate the URL</p>
  
  <pre><code>var url = GenerateUrl(controller, parameters);
  
                  var requestBody = GeneratedHttpContent(body);
                  if (requestBody == null) requestBody = new StringContent("");
  
                  **if (url.IsValidUrl())
                  {
                      response = await client.PutAsync(url, requestBody);
                  }
                  else
                  {
                      response = new HttpResponseMessage(HttpStatusCode.BadRequest);
                  }**
  
                  await LogError(response);
                  return response;
  </code></pre>
  
  <p>Here is the extension method with a VeraCode attribute</p>
  
  <pre><code>        [RedirectUrlCleanser]
          public static bool IsValidUrl(this string source)
          {
              return Uri.TryCreate(source, UriKind.RelativeOrAbsolute, out Uri uriResult) &amp;&amp; Uri.IsWellFormedUriString(source, UriKind.RelativeOrAbsolute);
          }
  </code></pre>
  
  <p>I can have VeraCode automatically mitigate based on the attribute, but our client will be performing their own scan and certainly won't have that setting enabled.</p>
  
  <p>Any ideas on how I can resolve this would be appreciated.</p>