SSRF Vulnerability while calling REST API

Question

I am using a method where it calls another REST API to retrieve an ID from the DB. When I run the veracode scan for the class I am getting Security flaw "Server-side Request Forgery" at below line.

response =  resttemplate.getForEntity(resturl, String.class);

Not sure How to fix this issue. Any help is appreciated. Below is my full code for that method.

public static String getIDFromDB(String resturl) {

  String id = null;
  RestTemplate resttemplate = new RestTemplate();
  ResponseEntity<String> response = new ResponseEntity<>(HTTPStatus.OK)
  try {
        response =  resttemplate.getForEntity(resturl, String.class);
        if (response.getStatusCode == HTTPStatus.OK && response.getBody.trim() != null) {
        id = response.getBody.trim() ;
      }
  } Catch(Exception e) {
     log.error("failed to get msgID: {}", e);
  }
}

Answer 1

This is because you are allowing in your code to pass the resturl completely in your code, so it enables the attacker to bypass and route the URL to their intended destination.

To avoid this, so should externalise and refer the URL having domain and the application contexts with operation name in config files or dB