Sending HTTP requests is security-sensitive. It has led in the past to the following vulnerabilities:

An HTTP request has different kinds of vulnerabilities:

This rule flags code that initiates an HTTP request. The goal is to guide security code reviews.

Ask Yourself Whether

You are at risk if you answered yes to any of those questions.

Recommended Secure Coding Practices

Questionable Code Example

// === Java URL connection ===
import java.net.URL;
import java.net.HttpURLConnection;

abstract class URLConnection {
    void foo() throws Exception {
        URL url = new URL("http://example.com");
        HttpURLConnection con = (HttpURLConnection) url.openConnection(); // Questionable: review how the http connection is used

        doSomething((HttpURLConnection) url.openConnection()); // Questionable: review how the http connection is used
    }

    abstract void doSomething(HttpURLConnection httpUrlConnection);
}
// === HttpClient Java 9 ===
import jdk.incubator.http.HttpClient;
import jdk.incubator.http.HttpRequest;
import jdk.incubator.http.HttpResponse;

class JavaNet9 {
    void foo(HttpRequest request, HttpResponse.BodyHandler<Object> responseBodyHandler, HttpResponse.MultiProcessor<?,?> multiProcessor) throws Exception {
        HttpClient client = HttpClient.newHttpClient();
        client.send(request, responseBodyHandler); // Questionable
        client.sendAsync(request, responseBodyHandler); // Questionable
        client.sendAsync(request, multiProcessor); // Questionable
    }
}
// === HttpClient Java 10 ===
import jdk.incubator.http.HttpClient;
import jdk.incubator.http.HttpRequest;
import jdk.incubator.http.HttpResponse;

class JavaNet10 {
    void foo(HttpRequest request, HttpResponse.BodyHandler<Object> responseBodyHandler, HttpResponse.MultiSubscriber<?,?> multiSubscriber) throws Exception {
        HttpClient client = HttpClient.newHttpClient();
        client.send(request, responseBodyHandler); // Questionable
        client.sendAsync(request, responseBodyHandler); // Questionable
        client.sendAsync(request, multiSubscriber); // Questionable
    }
}
// === HttpClient Java 11 ===
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

class JavaNet11 {
    void foo(HttpRequest request, HttpResponse.BodyHandler<Object> responseBodyHandler, HttpResponse.PushPromiseHandler<Object> pushPromiseHandler) throws Exception {
        HttpClient client = HttpClient.newHttpClient();
        client.send(request, responseBodyHandler); // Questionable
        client.sendAsync(request, responseBodyHandler); // Questionable
        client.sendAsync(request, responseBodyHandler, pushPromiseHandler); // Questionable
    }
}
// === apache ===
import org.apache.http.client.HttpClient;
import org.apache.http.client.ResponseHandler;
import org.apache.http.client.methods.HttpUriRequest;
import org.apache.http.HttpClientConnection;
import org.apache.http.HttpEntityEnclosingRequest;
import org.apache.http.HttpHost;
import org.apache.http.HttpRequest;
import org.apache.http.impl.client.HttpClientBuilder;
import org.apache.http.protocol.HttpContext;

class ApacheHttpClient {
    void foo(HttpClientConnection con, HttpHost target, HttpRequest request, HttpContext context,
            ResponseHandler<?> responseHandler, HttpUriRequest uriRequest, HttpEntityEnclosingRequest eeRequest)
            throws Exception {
        HttpClient client = HttpClientBuilder.create().build();

        // All the following are Questionable
        client.execute(target, request);
        client.execute(target, request, context);
        client.execute(target, request, responseHandler);
        client.execute(target, request, responseHandler, context);
        client.execute(uriRequest);
        client.execute(uriRequest, context);
        client.execute(uriRequest, responseHandler);
        client.execute(uriRequest, responseHandler, context);
        con.sendRequestEntity(eeRequest);
        con.sendRequestHeader(request);
    }
}
// === google-http-java-client ===
import java.util.concurrent.Executor;
import com.google.api.client.http.GenericUrl;
import com.google.api.client.http.HttpRequest;
import com.google.api.client.http.HttpRequestFactory;
import com.google.api.client.http.javanet.NetHttpTransport;

class GoogleHttpClient {
    void foo(Executor executor) throws Exception {
        HttpRequestFactory requestFactory = new NetHttpTransport().createRequestFactory();
        HttpRequest request = requestFactory.buildGetRequest(new GenericUrl("http://example.com"));

        // All the following are Questionable
        request.execute();
        request.executeAsync();
        request.executeAsync(executor);
    }
}

See