Heuristic_SQL_Injection issue exists @ src/main/java/org/joychou/controller/SSRF.java in branch master

The application's ssrf_HttpClient method executes an SQL query with httpGet, at line 172 of src\main\java\org\joychou\controller\SSRF.java. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.
This apparent database access is seemingly encapsulated in an external component or API.
Thus, it seems that the attacker might be able to inject arbitrary data into the SQL query, by altering the user input ""url"", which is read by the ssrf_HttpClient method, at line 172 of src\main\java\org\joychou\controller\SSRF.java. This input then flows through the code to the external API, and from there to a database server, apparently without sanitization.
This may enable an SQL Injection attack, based on heuristic analysis.

Severity: Low

CWE:89

Vulnerability details and guidance

Internal Guidance

Checkmarx

Lines: 201 203 172 174

Code (Line #201):

    public static String commonsHttpClient(HttpServletRequest request) {

Code (Line #203):

        String url = request.getParameter("url");

Code (Line #172):

    public static String ssrf_HttpClient(HttpServletRequest request) {

Code (Line #174):

        String url = request.getParameter("url");