codeql/java/ql/test/query-tests/security/CWE-918/ReactiveWebClientSSRF.java

import org.springframework.http.HttpHeaders;
import org.springframework.web.reactive.function.client.WebClient;
import reactor.core.publisher.Mono;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

public class ReactiveWebClientSSRF extends HttpServlet {
    protected void doGet(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {
        try {
            String url = request.getParameter("uri"); // $ Source
            WebClient webClient = WebClient.create(url); // $ Alert

            Mono<String> result = webClient.get()
                    .uri("/")
                    .retrieve()
                    .bodyToMono(String.class);

            result.block();
        } catch (Exception e) {
            // Ignore
        }
    }

    protected void doPost(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {
        try {
            String url = request.getParameter("uri"); // $ Source
            WebClient webClient = WebClient.builder()
                    .defaultHeader("User-Agent", "Java")
                    .baseUrl(url) // $ Alert
                    .build();


            Mono<String> result = webClient.get()
                    .uri("/")
                    .retrieve()
                    .bodyToMono(String.class);

            result.block();
        } catch (Exception e) {
            // Ignore
        }
    }

    protected void doPut(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {
        try {
            WebClient webClient = WebClient.create("https://example.com");

            String p = request.getParameter("uri"); // $ Source
            webClient.get()
                    .uri(p) // $ Alert
                    .retrieve()
                    .bodyToMono(String.class)
                    .block();

            String p2 = request.getParameter("uri"); // $ Source
            webClient.get()
                    .uri(java.net.URI.create("https://example.com" + p2)) // $ Alert
                    .retrieve()
                    .bodyToMono(String.class)
                    .block();
        } catch (Exception e) {
            // Ignore
        }
    }
}