标签: ssrf

长话短说，无论我尝试什么，VeraCode 都会继续将我的 8 行代码标记为 CWE 918 的缺陷。这是旧代码，所以我不确定为什么它会突然被标记。

这是一个示例 [offending] 方法，带有粗体标记的行

  public virtual async Task<HttpResponseMessage> Put(string controller = "", Dictionary<string, object> parameters = null, object body = null)
        {
            if (string.IsNullOrWhiteSpace(ApiBaseUrl)) return null;
            HttpResponseMessage response = null;

            using (var client = GetHttpClient())
            {
                client.BaseAddress = new Uri(ApiBaseUrl);

                if (!string.IsNullOrEmpty(Token)) client.DefaultRequestHeaders.Add("Token-Key", Token);
                if (!string.IsNullOrEmpty(DeviceId)) client.DefaultRequestHeaders.Add("DeviceId", DeviceId);

                var url = GenerateUrl(controller, parameters);

                var requestBody = GeneratedHttpContent(body);
                if (requestBody == null) requestBody = new StringContent("");

                **response = await client.PutAsync(url, requestBody);**

                await LogError(response);
                return response; …