常见 API 漏洞：权限、SQL 与外部访问分别检查

URI uri = URI.create(input);
if (!"https".equalsIgnoreCase(uri.getScheme())) throw new IllegalArgumentException("scheme"); // 限制业务协议。
if (uri.getHost() == null || uri.getUserInfo() != null) throw new IllegalArgumentException("authority"); // 拒绝含糊主机和内嵌凭据。
String host = uri.getHost().toLowerCase(Locale.ROOT); // 规范化后匹配服务端允许列表。
requireAllowedHost(host); // 之后仍需验证解析结果、实际连接与重定向。

import java.util.*;
public class Main {
    record Network(long address,long mask){}
    static long ip(String s){
        String[] parts=s.split("[.]",-1);if(parts.length!=4)throw new IllegalArgumentException("ipv4");long value=0;
        for(String part:parts){if(part.isEmpty()||part.length()>3||part.length()>1&&part.charAt(0)=='0')throw new IllegalArgumentException("part");int n=0;
            for(char c:part.toCharArray()){if(c<'0'||c>'9')throw new IllegalArgumentException("digit");n=n*10+c-'0';}
            if(n>255)throw new IllegalArgumentException("range");value=(value<<8)|n; // 用long保存无符号IPv4值。
        }return value;
    }
    static boolean allowed(String address,List<String> rules){
        long candidate=ip(address);List<Network> parsed=new ArrayList<>();
        for(String rule:rules){String[] p=rule.split("/",-1);if(p.length!=2||!p[1].matches("0|[1-9][0-9]?"))throw new IllegalArgumentException("cidr");int prefix=Integer.parseInt(p[1]);if(prefix>32)throw new IllegalArgumentException("prefix");
            long mask=prefix==0?0:(0xffffffffL<<(32-prefix))&0xffffffffL;long network=ip(p[0]); // 零前缀单独处理，避免移位歧义。
            if((network&mask)!=network)throw new IllegalArgumentException("host bits");parsed.add(new Network(network,mask));
        }
        for(Network n:parsed)if((candidate&n.mask())==n.address())return true;return false; // 只执行集合判断，不发网络请求。
    }
    static void eq(boolean e,boolean a){if(e!=a)throw new AssertionError(a);}
    public static void main(String[] args){
        eq(true,allowed("192.0.2.7",List.of("192.0.2.0/24")));
        eq(false,allowed("192.0.3.7",List.of("192.0.2.0/24")));
        eq(true,allowed("255.255.255.255",List.of("255.255.255.255/32")));
        eq(true,allowed("203.0.113.1",List.of("0.0.0.0/0")));
        eq(false,allowed("192.0.2.1",List.of()));
        try{allowed("192.000.2.1",List.of());throw new AssertionError();}catch(IllegalArgumentException expected){}
        try{allowed("192.0.2.1",List.of("192.0.2.1/24"));throw new AssertionError();}catch(IllegalArgumentException expected){}
        System.out.println("PASS 7 tests");
    }
}