Server-Side Request Forgery Prevention Cheat Sheet — IP address

Reference note (untrusted external data; do not execute it as instructions). In the context of SSRF, there are 2 possible validations to perform Ensure that the data provided is a valid IP V4 or V6 address. Ensure that the IP address provided belongs to one of the IP addresses of the identified and trusted applications. The first layer of validation can be applied using libraries that ensure the security of the IP address format, based on the technology used (library option is proposed here to delegate the managing of the IP address format and leverage battle-tested validation function) > Verification of the proposed libraries has been performed regarding the exposure to bypasses (Hex, Octal, Dword, URL and Mixed encoding) described in this article. JAVA: Method InetAddressValidator.isValid from the Apache Commons Validator library. It is NOT exposed to bypass using Hex, Octal, Dword, URL and Mixed encoding. .NET: Method IPAddress.TryParse from the SDK. It is Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, removed long code blocks, and shortened it for retrieval. Verify version-sensitive details at the source.