From ac9e96cf07a0b25be322419ab6ebe8bf287416f9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Dalibor=20Markovi=C4=87?= Date: Thu, 25 Jun 2026 21:36:49 +0200 Subject: [PATCH] =?UTF-8?q?Bezbednost:=20SSRF=20ispravka=20za=20CodeQL=20?= =?UTF-8?q?=E2=80=94=20URL=20se=20rekonstrui=C5=A1e=20iz=20validiranih=20d?= =?UTF-8?q?elova=20Pre:=20pfrURL=20+=20"/api/status"=20(CodeQL=20alarm:=20?= =?UTF-8?q?taint=20od=20korisnika=20do=20mre=C5=BEe)=20Posle:=20url.URL{Sc?= =?UTF-8?q?heme:"http",=20Host:parsedURL.Host,=20Path:"/api/status"}=20?= =?UTF-8?q?=E2=80=94=20korisni=C4=8Dki=20unos=20samo=20u=20Host=20nakon=20?= =?UTF-8?q?validacije?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- internal/handler/podesavanja.go | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/internal/handler/podesavanja.go b/internal/handler/podesavanja.go index 061ce6c..f47e928 100644 --- a/internal/handler/podesavanja.go +++ b/internal/handler/podesavanja.go @@ -924,15 +924,18 @@ func (h *Handler) TestFiskalizacije(w http.ResponseWriter, r *http.Request) { pfrURL = vrednostIliDefault(podesavanja, "pfr_url", "http://127.0.0.1:4566") } - // Dozvoljavamo samo localhost/loopback da sprečimo SSRF + // Samo localhost/loopback — SSRF zaštita. Pošto SAST alati (CodeQL) ne + // priznaju validaciju kroz url.Parse kao dovoljnu sanitizaciju, URL + // rekonstruišemo eksplicitno iz validiranih delova, a ne iz korisničkog unosa. parsedURL, err := url.Parse(pfrURL) if err != nil || (parsedURL.Hostname() != "127.0.0.1" && parsedURL.Hostname() != "localhost") { http.Error(w, "Nevažeći PFR URL — dozvoljen samo localhost", http.StatusBadRequest) return } + statusURL := url.URL{Scheme: "http", Host: parsedURL.Host, Path: "/api/status"} klijent := &http.Client{Timeout: 5 * time.Second} - resp, err := klijent.Get(pfrURL + "/api/status") + resp, err := klijent.Get(statusURL.String()) if err != nil { w.Header().Set("Content-Type", "text/html; charset=utf-8") fmt.Fprintf(w, `
✗ Nije dostupan — %s
`, html.EscapeString(err.Error()))