Fix SSRF (Server Side Request Forgery) in Bottle
SSRF in Bottle frameworks occurs when user-controlled input is passed directly to HTTP clients like 'requests' or 'urllib' without validation. This allows attackers to scan internal networks, hit metadata services (IMDS), or pivot into private infrastructure. To stop it, we implement strict allowlisting and network-level validation.
The Vulnerable Pattern
from bottle import route, request, run import requests
@route(‘/fetch’) def fetch_api(): # DANGER: Direct injection of user-provided URL target_url = request.query.get(‘url’) return requests.get(target_url).text
The Secure Implementation
The fix implements a multi-layered defense. First, we restrict the scheme to 'https' to prevent protocol smuggling (gopher/file). Second, we use an explicit domain allowlist. Third, we resolve the hostname to an IP address and verify it does not belong to private or link-local ranges, mitigating DNS rebinding and internal network probing. Finally, a timeout is added to the request to prevent resource exhaustion.
from bottle import route, request, HTTPError import requests from urllib.parse import urlparse import socketALLOWED_DOMAINS = [‘api.trusted.com’]
def validate_url(url): parsed = urlparse(url) # 1. Enforce HTTPS if parsed.scheme != ‘https’: return False # 2. Domain Allowlist if parsed.netloc not in ALLOWED_DOMAINS: return False # 3. Prevent Internal IP access (Anti-SSRF) try: ip_addr = socket.gethostbyname(parsed.hostname) private_ranges = [‘127.’, ‘10.’, ‘172.16.’, ‘192.168.’, ‘169.254.’] if any(ip_addr.startswith(prefix) for prefix in private_ranges): return False except Exception: return False return True
@route(‘/fetch’) def fetch_api(): target_url = request.query.get(‘url’) if not target_url or not validate_url(target_url): raise HTTPError(400, ‘Invalid or Forbidden URL’) return requests.get(target_url, timeout=5).text
Your Bottle API
might be exposed to SSRF (Server Side Request Forgery)
74% of Bottle apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.