メニュー
Generate secure code for HTTP request preventing exposure to DNS rebinding attack. Enforces HTTP request not exposed to DNS rebinding attack. Invoke when writing HTTP request code that must only target public IP addresses.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Generate secure microsoft excel file validation code. Enforces secure generation of code validating a microsoft excel file. Invoke when writing any microsoft excel file validation related code.
Generate secure microsoft word file validation code. Enforces secure generation of code validating a microsoft word file. Invoke when writing any microsoft word file validation related code. See "security-considerations" metadata for security limitations.
Generate secure relative url validation code for open redirect prevention. Enforces secure generation of code validating a relative url. Invoke when writing any relative url validation related code. See "security-considerations" metadata for strict validation behavior.
Generate secure pdf file validation code. Enforces secure generation of code validating a pdf file. Invoke when writing any pdf file validation related code.
Generate secure Comma Separated Values (CSV) generation code. Enforces secure generation of Comma Separated Values (CSV) content. Invoke when writing any Comma Separated Values (CSV) generation related code.
Generate secure email address validation code. Enforces secure generation of code validating an email address. Invoke when writing any email address validation related code.
| name | secure-http-request-dns-rebinding-prevention |
| description | Generate secure code for HTTP request preventing exposure to DNS rebinding attack. Enforces HTTP request not exposed to DNS rebinding attack. Invoke when writing HTTP request code that must only target public IP addresses. |
| allowed-tools | Read Grep Glob |
| metadata | {"category":"security"} |
Apply all rules below when generating or reviewing any code related to performing an HTTP request.
// BAD: No validation is performed for any points
public static String badCall(String targetUrl) throws Exception {
HttpClient client = HttpClient.newHttpClient();
HttpRequest request = HttpRequest.newBuilder().uri(URI.create(targetUrl)).GET().build();
HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
return response.body();
}
// GOOD: All the points are validated
public static String goodCall(String targetUrl) throws Exception {
URI uri = URI.create(targetUrl);
// Rule 1: Reject any scheme that is not http or https
String scheme = uri.getScheme();
if (scheme == null || (!scheme.equalsIgnoreCase("https") && !scheme.equalsIgnoreCase("http"))) {
throw new SecurityException("Blocked scheme: " + scheme);
}
String host = uri.getHost();
if (host == null || host.isBlank()) {
throw new SecurityException("Missing or blank hostname.");
}
InetAddress chosen = null;
for (InetAddress address : InetAddress.getAllByName(host)) {
// Rules 2–6: Reject private/site-local, multicast, link-local, loopback, and any-local addresses
if (address.isLoopbackAddress() || address.isSiteLocalAddress() || address.isLinkLocalAddress() || address.isAnyLocalAddress() || address.isMulticastAddress()) {
throw new SecurityException("Blocked non-public address: " + address.getHostAddress());
}
// Rule 2 (cont.): isSiteLocalAddress() covers fec0::/10 for IPv6 but not fc00::/7; check the unique-local range explicitly
if (address instanceof Inet6Address) {
byte[] bytes = address.getAddress();
if ((bytes[0] & 0xFE) == 0xFC) {
throw new SecurityException("Blocked IPv6 unique-local address: " + address.getHostAddress());
}
}
if (chosen == null || (!(chosen instanceof Inet4Address) && address instanceof Inet4Address)) {
chosen = address;
}
}
if (chosen == null) {
throw new SecurityException("Could not resolve hostname: " + host);
}
// Rule 7: Build the request URI from the validated IP address, not the hostname
int port = uri.getPort();
String ipLiteral = chosen instanceof Inet6Address ? "[" + chosen.getHostAddress() + "]" : chosen.getHostAddress();
URI resolvedUri = new URI(scheme, null, ipLiteral, port, uri.getPath(), uri.getQuery(), uri.getFragment());
// Rule 8: Disable automatic redirects to prevent bypass via redirect to a private address
HttpClient client = HttpClient.newBuilder().connectTimeout(Duration.ofSeconds(10)).followRedirects(HttpClient.Redirect.NEVER).build();
// Rule 9: Set a request timeout to prevent indefinite blocking (default: 10 seconds)
HttpRequest request = HttpRequest.newBuilder().uri(resolvedUri).timeout(Duration.ofSeconds(10)).header("Host", port != -1 ? host + ":" + port : host).GET().build();
return client.send(request, HttpResponse.BodyHandlers.ofString()).body();
}
Before finalizing generated code, verify: