owasp-top-10

The fragment documents SSRF and includes an intentionally vulnerable example where user input reaches fetch() without validation. The secure example demonstrates an allow-list mitigation but is not comprehensive against all SSRF bypasses. It contains no evidence of supply-chain malware or malicious intent; the primary security concern is the explicitly shown vulnerable pattern if copied into an application.