### Common Characteristics of SSRF Vulnerabilities

- During analysis, if there are security protection/validation functions, the corresponding parameter is integer or boolean type (unexploitable), or it cannot be directly controlled (e.g., read from configuration files, environment variables, database queries, or other methods that are not actually directly controllable and require prior control of the corresponding file or environment), the conclusion should be that no security vulnerability exists.
- Special attention: the criteria for determining an SSRF vulnerability are as follows:
    - The vulnerability is only considered to exist when the URL is controllable to access arbitrary addresses. For example, `http://ip:8080/test` where the IP is controllable, or `http://domain/test` where the domain is controllable.
    - If only partial parameters of the interface are controllable and passed to the request function but cannot access arbitrary addresses (such as `/v1/tenants/%s/devices`), the conclusion should be that no security vulnerability exists.
    - If only the request body in the request function is controllable but the URL path is not, the conclusion should be that no security vulnerability exists.
