From a2a80bb04c16120ec66ac8d3ae8df7351ff5dc76 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Dalibor=20Markovi=C4=87?= Date: Thu, 25 Jun 2026 21:36:49 +0200 Subject: [PATCH] =?UTF-8?q?Bezbednost:=20SSRF=20ispravka=20za=20CodeQL=20?= =?UTF-8?q?=E2=80=94=20URL=20se=20rekonstrui=C5=A1e=20iz=20validiranih=20d?= =?UTF-8?q?elova?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Pre: pfrURL + "/api/status" (CodeQL alarm: taint od korisnika do mreže) Posle: url.URL{Scheme:"http", Host:parsedURL.Host, Path:"/api/status"} — korisnički unos samo u Host nakon validacije --- internal/handler/podesavanja.go | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/internal/handler/podesavanja.go b/internal/handler/podesavanja.go index 061ce6c..f47e928 100644 --- a/internal/handler/podesavanja.go +++ b/internal/handler/podesavanja.go @@ -924,15 +924,18 @@ func (h *Handler) TestFiskalizacije(w http.ResponseWriter, r *http.Request) { pfrURL = vrednostIliDefault(podesavanja, "pfr_url", "http://127.0.0.1:4566") } - // Dozvoljavamo samo localhost/loopback da sprečimo SSRF + // Samo localhost/loopback — SSRF zaštita. Pošto SAST alati (CodeQL) ne + // priznaju validaciju kroz url.Parse kao dovoljnu sanitizaciju, URL + // rekonstruišemo eksplicitno iz validiranih delova, a ne iz korisničkog unosa. parsedURL, err := url.Parse(pfrURL) if err != nil || (parsedURL.Hostname() != "127.0.0.1" && parsedURL.Hostname() != "localhost") { http.Error(w, "Nevažeći PFR URL — dozvoljen samo localhost", http.StatusBadRequest) return } + statusURL := url.URL{Scheme: "http", Host: parsedURL.Host, Path: "/api/status"} klijent := &http.Client{Timeout: 5 * time.Second} - resp, err := klijent.Get(pfrURL + "/api/status") + resp, err := klijent.Get(statusURL.String()) if err != nil { w.Header().Set("Content-Type", "text/html; charset=utf-8") fmt.Fprintf(w, `
✗ Nije dostupan — %s
`, html.EscapeString(err.Error()))