feat(ssrf): add missing transport wrappings and more checks BE-13021 (#2968)

api/stacks/stackbuilders/stack_git_builder.go

@@ -13,6 +13,7 @@ import (
 	"github.com/portainer/portainer/api/scheduler"
 	"github.com/portainer/portainer/api/stacks/deployments"
 	"github.com/portainer/portainer/api/stacks/stackutils"
+	"github.com/portainer/portainer/pkg/libhttp/ssrf"
 )
 
 type GitMethodStackBuilder struct {
@@ -78,6 +79,10 @@ func (b *GitMethodStackBuilder) prepare(ctx context.Context, payload *StackPaylo
 		return b.fileService.GetStackProjectPath(stackFolder)
 	}
 
+	if err := ssrf.CheckURL(ctx, repoConfig.URL); err != nil {
+		return fmt.Errorf("repository URL blocked by SSRF policy: %w", err)
+	}
+
 	commitHash, err := stackutils.DownloadGitRepository(ctx, repoConfig, b.gitService, getProjectPath)
 	if err != nil {
 		return fmt.Errorf("failed to download git repository: %w", err)