Server-side request forgery
Outbound requests should not use attacker-controlled targets or private hosts.
#Metadata
#Why it matters
Request-controlled targets can force the server to call internal services, metadata endpoints, or attacker-controlled infrastructure.
#Remediation
Resolve URLs against a trusted allowlist, reject private hosts, and proxy outbound requests through a vetted server-side helper.
#Repository path
The generated metadata points to critiq-rules/libs/rules/catalog/rules/typescript/ts.security.ssrf.rule.yaml.