메뉴
Generate secure code for HTTP request preventing exposure to DNS rebinding attack. Enforces HTTP request not exposed to DNS rebinding attack. Invoke when writing HTTP request code that must only target public IP addresses.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Generate secure microsoft excel file validation code. Enforces secure generation of code validating a microsoft excel file. Invoke when writing any microsoft excel file validation related code.
Generate secure microsoft word file validation code. Enforces secure generation of code validating a microsoft word file. Invoke when writing any microsoft word file validation related code. See "security-considerations" metadata for security limitations.
Generate secure relative url validation code for open redirect prevention. Enforces secure generation of code validating a relative url. Invoke when writing any relative url validation related code. See "security-considerations" metadata for strict validation behavior.
Generate secure pdf file validation code. Enforces secure generation of code validating a pdf file. Invoke when writing any pdf file validation related code.
Generate secure Comma Separated Values (CSV) generation code. Enforces secure generation of Comma Separated Values (CSV) content. Invoke when writing any Comma Separated Values (CSV) generation related code.
Generate secure email address validation code. Enforces secure generation of code validating an email address. Invoke when writing any email address validation related code.
| name | secure-http-request-dns-rebinding-prevention |
| description | Generate secure code for HTTP request preventing exposure to DNS rebinding attack. Enforces HTTP request not exposed to DNS rebinding attack. Invoke when writing HTTP request code that must only target public IP addresses. |
| allowed-tools | Read Grep Glob |
| metadata | {"category":"security"} |
Apply all rules below when generating or reviewing any code related to performing an HTTP request.
// BAD: No validation is performed for any points
public static String badCall(String targetUrl) throws Exception {
HttpClient client = HttpClient.newHttpClient();
HttpRequest request = HttpRequest.newBuilder().uri(URI.create(targetUrl)).GET().build();
HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
return response.body();
}
// GOOD: All the points are validated
public static String goodCall(String targetUrl) throws Exception {
URI uri = URI.create(targetUrl);
// Rule 1: Reject any scheme that is not http or https
String scheme = uri.getScheme();
if (scheme == null || (!scheme.equalsIgnoreCase("https") && !scheme.equalsIgnoreCase("http"))) {
throw new SecurityException("Blocked scheme: " + scheme);
}
String host = uri.getHost();
if (host == null || host.isBlank()) {
throw new SecurityException("Missing or blank hostname.");
}
InetAddress chosen = null;
for (InetAddress address : InetAddress.getAllByName(host)) {
// Rules 2–6: Reject private/site-local, multicast, link-local, loopback, and any-local addresses
if (address.isLoopbackAddress() || address.isSiteLocalAddress() || address.isLinkLocalAddress() || address.isAnyLocalAddress() || address.isMulticastAddress()) {
throw new SecurityException("Blocked non-public address: " + address.getHostAddress());
}
// Rule 2 (cont.): isSiteLocalAddress() covers fec0::/10 for IPv6 but not fc00::/7; check the unique-local range explicitly
if (address instanceof Inet6Address) {
byte[] bytes = address.getAddress();
if ((bytes[0] & 0xFE) == 0xFC) {
throw new SecurityException("Blocked IPv6 unique-local address: " + address.getHostAddress());
}
}
if (chosen == null || (!(chosen instanceof Inet4Address) && address instanceof Inet4Address)) {
chosen = address;
}
}
if (chosen == null) {
throw new SecurityException("Could not resolve hostname: " + host);
}
// Rule 7: Build the request URI from the validated IP address, not the hostname
int port = uri.getPort();
String ipLiteral = chosen instanceof Inet6Address ? "[" + chosen.getHostAddress() + "]" : chosen.getHostAddress();
URI resolvedUri = new URI(scheme, null, ipLiteral, port, uri.getPath(), uri.getQuery(), uri.getFragment());
// Rule 8: Disable automatic redirects to prevent bypass via redirect to a private address
HttpClient client = HttpClient.newBuilder().connectTimeout(Duration.ofSeconds(10)).followRedirects(HttpClient.Redirect.NEVER).build();
// Rule 9: Set a request timeout to prevent indefinite blocking (default: 10 seconds)
HttpRequest request = HttpRequest.newBuilder().uri(resolvedUri).timeout(Duration.ofSeconds(10)).header("Host", port != -1 ? host + ":" + port : host).GET().build();
return client.send(request, HttpResponse.BodyHandlers.ofString()).body();
}
Before finalizing generated code, verify: