Server-side request forgery (SSRF) via Playwright

Description

If unverified user data can reach the `playwright` methods it can result in Server-Side Request Forgery vulnerabilities.

Examples

Insecure Code

const playwright = require('playwright');
const url = req.query.url;
const browser = await playwright.chromium.launch();
const page = await browser.newPage();
await page.goto(url);

Secure Code

const playwright = require('playwright');
const url = req.query.url;
if (validateUrl(url)) {
  const browser = await playwright.chromium.launch();
  const page = await browser.newPage();
  await page.goto(url);
} else {
  // Handle invalid URL
}

Remediation

Validate and sanitize user input before passing it to Playwright methods.

Rule Details

Field	Value
ID	CODE-0412
Category	Injection
Severity	CRITICAL
CWE	CWE-918
Confidence	HIGH
Impact	HIGH
Likelihood	MEDIUM
Exploitability	EASY
Tags	SSRF, Server-side request forgery
OWASP	A1:2017-Injection, A03:2021-Injection

---