Dasko/GoNtech
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Bezbednost: SSRF ispravka za CodeQL — URL se rekonstruiše iz validiranih delova

Browse Source 
Pre: pfrURL + "/api/status" (CodeQL alarm: taint od korisnika do mreže)
Posle: url.URL{Scheme:"http", Host:parsedURL.Host, Path:"/api/status"} — korisnički unos samo u Host nakon validacije
This commit is contained in:
Dasko
2026-06-25 21:36:49 +02:00
parent 5430a9015b
commit a2a80bb04c
1 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/handler/podesavanja.go
+5 -2
View File
@@ -924,15 +924,18 @@ func (h *Handler) TestFiskalizacije(w http.ResponseWriter, r *http.Request) {
pfrURL = vrednostIliDefault(podesavanja, "pfr_url", "http://127.0.0.1:4566") pfrURL = vrednostIliDefault(podesavanja, "pfr_url", "http://127.0.0.1:4566")
} }
// Dozvoljavamo samo localhost/loopback da sprečimo SSRF // Samo localhost/loopback — SSRF zaštita. Pošto SAST alati (CodeQL) ne
// priznaju validaciju kroz url.Parse kao dovoljnu sanitizaciju, URL
// rekonstruišemo eksplicitno iz validiranih delova, a ne iz korisničkog unosa.
parsedURL, err := url.Parse(pfrURL) parsedURL, err := url.Parse(pfrURL)
if err != nil || (parsedURL.Hostname() != "127.0.0.1" && parsedURL.Hostname() != "localhost") { if err != nil || (parsedURL.Hostname() != "127.0.0.1" && parsedURL.Hostname() != "localhost") {
http.Error(w, "Nevažeći PFR URL — dozvoljen samo localhost", http.StatusBadRequest) http.Error(w, "Nevažeći PFR URL — dozvoljen samo localhost", http.StatusBadRequest)
return return
} }
statusURL := url.URL{Scheme: "http", Host: parsedURL.Host, Path: "/api/status"}
klijent := &http.Client{Timeout: 5 * time.Second} klijent := &http.Client{Timeout: 5 * time.Second}
resp, err := klijent.Get(pfrURL + "/api/status") resp, err := klijent.Get(statusURL.String())
if err != nil { if err != nil {
w.Header().Set("Content-Type", "text/html; charset=utf-8") w.Header().Set("Content-Type", "text/html; charset=utf-8")
fmt.Fprintf(w, `<div class="fisk-status greska">&#10007; Nije dostupan — %s</div>`, html.EscapeString(err.Error())) fmt.Fprintf(w, `<div class="fisk-status greska">&#10007; Nije dostupan — %s</div>`, html.EscapeString(err.Error()))