Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/abderrahimghazali/cursor-rules/javascript-server-side-request-forgerygit clone --depth 1 https://github.com/abderrahimghazali/cursor-rulesWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.07288 | $0.07288 |
| Opus 5 | $0.03644 | $0.03644 |
| Sonnet 5 | $0.01458 | $0.01458 |
| Haiku 4.5 | $0.00729 | $0.00729 |
Grade A, and why
javascript-server-side-request-forgery scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- pattern: "function\\s+[a-zA-Z0-9_]*(?:request|fetch|get|http|curl)\\s*\\([^)]*\\)\\s*\\{[^}]*(?:fetch|axios|http\\.get|http\\.request|https\\.get|https\\.request)" This is a copy
100% identical to javascript-server-side-request-forgery — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 851 lines — stays where its author put it; the contents beside it link to each section on GitHub.
description: Detect and prevent Server-Side Request Forgery (SSRF) vulnerabilities in JavaScript applications as defined in OWASP Top 10:2021-A10 globs: /.js, **/.jsx, /.ts, **/.tsx, !/node_modules/, !/dist/, !/build/, !/coverage/
JavaScript Server-Side Request Forgery (OWASP A10:2021)
actions:
-
type: enforce conditions:
Pattern 1: URL from User Input
- pattern: "(fetch|axios\.get|axios\.post|axios\.put|axios\.delete|axios\.patch|http\.get|http\.request|https\.get|https\.request|\$\.ajax|XMLHttpRequest|got|request|superagent|needle)\s*\([^)]*(?:\$_GET|\$_POST|\$_REQUEST|req\.(?:body|query|params)|request\.(?:body|query|params)|event\.(?:body|queryStringParameters|pathParameters)|params|userInput|data\[" message: "Potential SSRF vulnerability: URL constructed from user input. Implement URL validation, allowlisting, or use a URL parser library to validate and sanitize user-provided URLs."
Pattern 2: Dynamic URL in HTTP Request
- pattern: "(fetch|axios|http\.get|http\.request|https\.get|https\.request|\$\.ajax|XMLHttpRequest|got|request|superagent|needle)\s*\(\s*['"
]https?:\\/\\/[^'\"]['"`]\s\+\s*" message: "Potential SSRF vulnerability: Dynamic URL in HTTP request. Use URL parsing and validation before making the request."
Pattern 3: URL Redirection Without Validation
- pattern: "(res\.redirect|res\.location|window\.location|location\.href|location\.replace|location\.assign|location\.port|history\.pushState|history\.replaceState)\s*\([^)]*(?:req\.(?:query|body|params)|request\.(?:query|body|params)|userInput)" message: "URL redirection without proper validation may lead to SSRF. Implement strict validation for URLs before redirecting."
Pattern 4: Direct IP Address Usage
- pattern: "(fetch|axios\.get|axios\.post|axios\.put|axios\.delete|axios\.patch|http\.get|http\.request|https\.get|https\.request)\s*\(\s*['"`]https?:\/\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}" message: "Direct use of IP addresses in requests may bypass hostname-based restrictions. Consider using allowlisted hostnames instead."
Pattern 5: Local Network Access
- pattern: "(fetch|axios\.get|axios\.post|axios\.put|axios\.delete|axios\.patch|http\.get|http\.request|https\.get|https\.request)\s*\(\s*['"`]https?:\/\/(?:localhost|127\.0\.0\.1|0\.0\.0\.0|192\.168\.|10\.|172\.(?:1[6-9]|2[0-9]|3[0-1])\.|::1)" message: "Request to internal network address detected. Restrict access to internal resources to prevent SSRF attacks."
Pattern 6: File Protocol Usage
- pattern: "(fetch|axios\.get|axios\.post|axios\.put|axios\.delete|axios\.patch|http\.get|http\.request|https\.get|https\.request)\s*\(\s*['"`]file:\/\/" message: "Use of file:// protocol may lead to local file access. Block or restrict file:// protocol usage."
Pattern 7: Missing URL Validation
- pattern: "(fetch|axios\.get|axios\.post|axios\.put|axios\.delete|axios\.patch|http\.get|http\.request|https\.get|https\.request)\s*\([^)]\burl\b[^)]\)" negative_pattern: "(validat|sanitiz|check|parse).*\burl\b|allowlist|whitelist|URL\.(parse|canParse)|new URL\(|isValidURL" message: "HTTP request without URL validation. Implement URL validation before making external requests."
Pattern 8: HTTP Request in User-Defined Function
- pattern: "function\s+[a-zA-Z0-9_](?:request|fetch|get|http|curl)\s\([^)]\)\s\{[^}](?:fetch|axios|http\.get|http\.request|https\.get|https\.request)" negative_pattern: "(validat|sanitiz|check|parse).\burl\b|allowlist|whitelist|new URL\(|isValidURL" message: "User-defined HTTP request function without URL validation. Implement proper URL validation and sanitization."
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 851 lines · 7,288 tokens per session scan A b64662fb2333
javascript-server-side-request-forgery is a cursor rule published in the GitHub repository abderrahimghazali/cursor-rules (2 stars, last pushed 1y ago), licensed MIT. It adds 7,288 tokens to every session, about $0.0364 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). It is 100% identical to javascript-server-side-request-forgery, differing in 0 lines, and is treated as a copy.
Other cursor rules, from other repositories
creating-cursor-rules
Meta-rule for creating effective Cursor IDE rules with best practices, patterns, and examples.
creating-skills
Meta-guide for creating effective Claude Code skills with proper structure, CSO optimization, and real examples.
cursorrules
You are a disciplined senior engineer working with someone who may be a domain expert, not a programmer. Build it correctly and safely, not just fast.
cursorrules
Cursor rule "cursorrules" from BlueBirdBack/godot-cursorrules, covering godot 4.4 game development .cursorrules, core development guidelines, code style, naming conventions and scene organization.
new_feature
You are an expert Product Owner and Technical Lead focused on helping users define and plan new features through collaborative discovery and structured documentation.
new_project
You are an expert Product Owner focused on helping users define new software projects through collaborative vision creation.