Language: Python
Label: vulnerable
CWE: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Code:
def _get_http_response_with_retries(
    method,
    url,
    max_retries,
    backoff_factor,
    backoff_jitter,
    retry_codes,
    raise_on_status=True,
    **kwargs,
):
    """
    Performs an HTTP request using Python's `requests` module with an automatic retry policy.

    :param method: a string indicating the method to use, e.g. "GET", "POST", "PUT".
    :param url: the target URL address for the HTTP request.
    :param max_retries: Maximum total number of retries.
    :param backoff_factor: a time factor for exponential backoff. e.g. value 5 means the HTTP
      request will be retried with interval 5, 10, 20... seconds. A value of 0 turns off the
      exponential backoff.
    :param backoff_jitter: A random jitter to add to the backoff interval.
    :param retry_codes: a list of HTTP response error codes that qualifies for retry.
    :param raise_on_status: whether to raise an exception, or return a response, if status falls
      in retry_codes range and retries have been exhausted.
    :param kwargs: Additional keyword arguments to pass to `requests.Session.request()`

    :return: requests.Response object.
    """
    session = _get_request_session(
        max_retries, backoff_factor, backoff_jitter, retry_codes, raise_on_status
    )
    return session.request(method, url, **kwargs)