feat(java): detect Kong Unirest HTTP requests to a non-literal URL (CWE-918)

[ai-anant]

Summary

Add a Java/Jenkins rule that flags a Kong Unirest HTTP request (Unirest.get/post/put/patch/delete/head/options/request) whose URL argument is not a string literal.

Pattern

Unirest.$METHOD($URL) where the argument is a variable, field, method result, or expression (non-literal) — an SSRF sink when that URL derives from configurable or attacker-influenced input with no host allowlist.

Why it matters

Unirest is a fluent HTTP client used by many Jenkins plugins. A non-literal URL combines a configurable base endpoint with a path, letting an authenticated user redirect the request to internal services (127.0.0.1, cloud metadata 169.254.169.254, other nodes) or an attacker-controlled host — and any Authorization/basic-auth credential attached to the request is disclosed to that destination.

Validation

• semgrep --validate --config java/ passes.
• Positive fixture (non-literal URL built from a config field) fires.
• Negative fixture (literal URL, and literal assigned to a variable) does not fire.

Closes nothing. Rule ID: codevigilant.java.jenkins.ssrf.unirest.nonliteral-url.