← all rules
code/py-urllib-ssrf
SSRF: urllib.request.urlopen with user input
What it detects
urllib.request.urlopen resolves arbitrary schemes (file://, ftp://) and is rarely the right primitive for user-supplied URLs.
How it runs
Applied line-by-line via a tagged regex with language-specific gating. Comments are skipped. Designed for high-confidence patterns where AST parsing would be overkill.
Found a false positive or want this rule tuned? File an issue. You can also suppress per-repo via a .repoguardignore line.