← all rules
code/py-ssrf-requests-user-input
SSRF: requests library called with user-controlled URL
What it detects
A Python HTTP client is called with a URL derived from Flask/Django/FastAPI request data.
How it runs
Applied line-by-line via a tagged regex with language-specific gating. Comments are skipped. Designed for high-confidence patterns where AST parsing would be overkill.
Found a false positive or want this rule tuned? File an issue. You can also suppress per-repo via a .repoguardignore line.