codeql/javascript/ql/test/experimental/Security/CWE-918/check-domain.js

// native modules
const url = require('url');

// dependencies
const axios = require('axios');
const express = require('express');

// constants
const VALID_DOMAINS = ['example.com', 'example-2.com'];

// start
const app = express();

app.get('/check-with-axios', req => {
  // without validation
  const url = req.query.url; // $ Source
  axios.get(url); // $ Alert // SSRF

  // validating domain only
  const decodedURI = decodeURIComponent(req.query.url);
  const { hostname } = url.parse(decodedURI);

  const { hostname } = url.parse(decodedURI);

  if (isValidDomain(hostname, VALID_DOMAINS)) {
    axios.get(req.query.url); // $ Alert // SSRF
  }
});

const isValidDomain = (hostname, validDomains) => (
  validDomains.some(domain => (
    hostname === domain || hostname.endsWith(`.${domain}`))
  )
);