fix(pipeline): validate CDN URLs against SSRF

HTTPS-only CDN URLs; блокировка private/loopback/metadata IP и DNS-resolve на fetch; проверка в httpapi при create/preview/patch CDN sources. Co-authored-by: Cursor <[email protected]>
2026-05-25 10:14:10 +07:00
parent 5a16a45922
commit 82382d90f2
6 changed files with 202 additions and 6 deletions
@@ -0,0 +1,34 @@
+package pipeline
+
+import "testing"
+
+func TestValidateCDNURL(t *testing.T) {
+	tests := []struct {
+		raw  string
+		ok   bool
+		want string
+	}{
+		{"https://cdn.example.com/prefixes.txt", true, "https://cdn.example.com/prefixes.txt"},
+		{"http://cdn.example.com/x", false, ""},
+		{"https://127.0.0.1/x", false, ""},
+		{"https://10.0.0.1/x", false, ""},
+		{"https://169.254.169.254/latest/meta-data", false, ""},
+		{"https://localhost/x", false, ""},
+		{"file:///etc/passwd", false, ""},
+		{"https://user:[email protected]/x", false, ""},
+	}
+	for _, tc := range tests {
+		got, err := ValidateCDNURL(tc.raw)
+		if tc.ok && err != nil {
+			t.Errorf("%q: unexpected err %v", tc.raw, err)
+			continue
+		}
+		if !tc.ok && err == nil {
+			t.Errorf("%q: expected error", tc.raw)
+			continue
+		}
+		if tc.ok && got != tc.want {
+			t.Errorf("%q: got %q want %q", tc.raw, got, tc.want)
+		}
+	}
+}