菜单
Generate secure code for HTTP request preventing exposure to DNS rebinding attack. Enforces HTTP request not exposed to DNS rebinding attack. Invoke when writing HTTP request code that must only target public IP addresses.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Generate secure microsoft excel file validation code. Enforces secure generation of code validating a microsoft excel file. Invoke when writing any microsoft excel file validation related code.
Generate secure microsoft word file validation code. Enforces secure generation of code validating a microsoft word file. Invoke when writing any microsoft word file validation related code. See "security-considerations" metadata for security limitations.
Generate secure relative url validation code for open redirect prevention. Enforces secure generation of code validating a relative url. Invoke when writing any relative url validation related code. See "security-considerations" metadata for strict validation behavior.
Generate secure pdf file validation code. Enforces secure generation of code validating a pdf file. Invoke when writing any pdf file validation related code.
Generate secure Comma Separated Values (CSV) generation code. Enforces secure generation of Comma Separated Values (CSV) content. Invoke when writing any Comma Separated Values (CSV) generation related code.
Generate secure email address validation code. Enforces secure generation of code validating an email address. Invoke when writing any email address validation related code.
| name | secure-http-request-dns-rebinding-prevention |
| description | Generate secure code for HTTP request preventing exposure to DNS rebinding attack. Enforces HTTP request not exposed to DNS rebinding attack. Invoke when writing HTTP request code that must only target public IP addresses. |
| allowed-tools | Read Grep Glob |
| metadata | {"category":"security"} |
Apply all rules below when generating or reviewing any code related to performing an HTTP request.
// BAD: No validation is performed for any points
public static String badCall(String targetUrl) throws Exception {
HttpClient client = HttpClient.newHttpClient();
HttpRequest request = HttpRequest.newBuilder().uri(URI.create(targetUrl)).GET().build();
HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
return response.body();
}
// GOOD: All the points are validated
public static String goodCall(String targetUrl) throws Exception {
URI uri = URI.create(targetUrl);
// Rule 1: Reject any scheme that is not http or https
String scheme = uri.getScheme();
if (scheme == null || (!scheme.equalsIgnoreCase("https") && !scheme.equalsIgnoreCase("http"))) {
throw new SecurityException("Blocked scheme: " + scheme);
}
String host = uri.getHost();
if (host == null || host.isBlank()) {
throw new SecurityException("Missing or blank hostname.");
}
InetAddress chosen = null;
for (InetAddress address : InetAddress.getAllByName(host)) {
// Rules 2–6: Reject private/site-local, multicast, link-local, loopback, and any-local addresses
if (address.isLoopbackAddress() || address.isSiteLocalAddress() || address.isLinkLocalAddress() || address.isAnyLocalAddress() || address.isMulticastAddress()) {
throw new SecurityException("Blocked non-public address: " + address.getHostAddress());
}
// Rule 2 (cont.): isSiteLocalAddress() covers fec0::/10 for IPv6 but not fc00::/7; check the unique-local range explicitly
if (address instanceof Inet6Address) {
byte[] bytes = address.getAddress();
if ((bytes[0] & 0xFE) == 0xFC) {
throw new SecurityException("Blocked IPv6 unique-local address: " + address.getHostAddress());
}
}
if (chosen == null || (!(chosen instanceof Inet4Address) && address instanceof Inet4Address)) {
chosen = address;
}
}
if (chosen == null) {
throw new SecurityException("Could not resolve hostname: " + host);
}
// Rule 7: Build the request URI from the validated IP address, not the hostname
int port = uri.getPort();
String ipLiteral = chosen instanceof Inet6Address ? "[" + chosen.getHostAddress() + "]" : chosen.getHostAddress();
URI resolvedUri = new URI(scheme, null, ipLiteral, port, uri.getPath(), uri.getQuery(), uri.getFragment());
// Rule 8: Disable automatic redirects to prevent bypass via redirect to a private address
HttpClient client = HttpClient.newBuilder().connectTimeout(Duration.ofSeconds(10)).followRedirects(HttpClient.Redirect.NEVER).build();
// Rule 9: Set a request timeout to prevent indefinite blocking (default: 10 seconds)
HttpRequest request = HttpRequest.newBuilder().uri(resolvedUri).timeout(Duration.ofSeconds(10)).header("Host", port != -1 ? host + ":" + port : host).GET().build();
return client.send(request, HttpResponse.BodyHandlers.ofString()).body();
}
Before finalizing generated code, verify: