Fix SSRF (Server Side Request Forgery) in Dropwizard

@Path("/fetch")
@Produces(MediaType.APPLICATION_JSON)
public class ProxyResource {
    private final Client client;
public ProxyResource(Client client) {
    this.client = client;
}

@GET
public Response proxy(@QueryParam("url") String url) {
    // CRITICAL: No validation on the 'url' parameter.
    // Attacker can pass 'http://localhost:8080/admin' or 'http://169.254.169.254/latest/meta-data/'
    return client.target(url).request().get();
}
}

public class SafeClient {
    private static final Set ALLOWED_HOSTS = Set.of("trusted-api.com");
public Response safeFetch(String urlString) throws Exception {
    URL url = new URL(urlString);
    if (!"https".equalsIgnoreCase(url.getProtocol())) {
        throw new WebApplicationException("Only HTTPS allowed", 400);
    }

    InetAddress address = InetAddress.getByName(url.getHost());
    if (address.isLoopbackAddress() || address.isSiteLocalAddress() || address.isLinkLocalAddress()) {
        throw new WebApplicationException("Internal access forbidden", 403);
    }

    if (!ALLOWED_HOSTS.contains(url.getHost())) {
        throw new WebApplicationException("Domain not in allowlist", 403);
    }

    // Use a dedicated client with a custom DnsResolver to prevent DNS Rebinding
    return client.target(url.toURI()).request().get();
}
}