## Path Traversal + SSRF (High)

### Trigger Signals

- File path from user input (`open`, `readFile`, `send_file`, `fs.readFile` parameter controllable)
- URL from user input and making requests (`fetch`, `http.get`, `requests.get`, `urllib.open`)
- Redirect target from user input (`redirect(req.query.url)`, `Location: user_input`)

### Key Sinks

| Vulnerability Type | Sink Functions |
|---------|----------|
| Path Traversal | `open(path)`, `readFile(path)`, `writeFile(path)`, `send_file(path)`, `fs.stat(path)` |
| SSRF | `fetch(url)`, `http.get(url)`, `requests.get(url)`, `axios(url)`, `url.openConnection()` |
| Open Redirect | `redirect(url)`, `res.redirect(url)`, `response.sendRedirect(url)`, `Location: url` |

### Judgment Process

**Path Traversal**:
1. **Identify Sink**: `Read` extracts file operation function calls, marking file path parameters
2. **Trace back to Source**: `find_references` traces the origin of path parameters, determining whether they come from user input
3. **Check path validation**: `Read` checks whether path parameters have been:
   - Validated after path normalization (checked against allowed directory after `realpath`/`resolve`)
   - Extension whitelist (only allowing specific file types)
   - Base directory path joining (`path.join(BASE_DIR, filename)` followed by validation)
4. **Verify bypass risk**: `Read` determines whether bypass is possible (e.g., `../` filtered but `..\/` not filtered, URL encoding bypass)

**SSRF**:
1. **Identify Sink**: `Read` extracts HTTP request function calls, marking URL parameters
2. **Trace back to Source**: `find_references` traces the URL origin, determining whether it comes from user input
3. **Check URL validation**: `Read` confirms whether the following exist:
   - URL whitelist/domain whitelist
   - Protocol restriction (only allowing http/https, forbidding file/gopher/dict)
   - Internal IP filtering (blocking 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
   - DNS rebinding protection

**Open Redirect**:
1. **Identify Sink**: `Read` extracts redirect operations, marking target URL parameters
2. **Check URL validation**: `Read` confirms whether the target URL's domain has been validated (whitelist or relative path restriction)

### Evidence Construction

After confirming a defect, the output must include:
- Source (user input origin, with file:line number)
- Sink (dangerous operation location, with file:line number)
- Missing validation (path normalization, URL whitelist, internal network filtering)
- Exploitation scenario (`../../etc/passwd`, `http://169.254.169.254/metadata`, `https://evil.com?redirect=trustedsite`)

### Exclusions

- Path validated with `realpath` + `startsWith(BASE_DIR)`
- URL already has domain whitelist + protocol restriction + internal IP filtering
- Redirect only allows relative paths (`/path` instead of full URL)
- UUID/auto-increment ID already used instead of user-provided filenames
