feat(ssrf): add missing transport wrappings and more checks BE-13021 (#2967)

api/http/handler/gitops/git_repo_file_preview.go

@@ -12,6 +12,7 @@ import (
 	httperror "github.com/portainer/portainer/pkg/libhttp/error"
 	"github.com/portainer/portainer/pkg/libhttp/request"
 	"github.com/portainer/portainer/pkg/libhttp/response"
+	"github.com/portainer/portainer/pkg/libhttp/ssrf"
 	"github.com/portainer/portainer/pkg/validate"
 	"github.com/rs/zerolog/log"
 )
@@ -100,6 +101,10 @@ func (handler *Handler) gitOperationRepoFilePreview(w http.ResponseWriter, r *ht
 		tlsSkipVerify = src.Git.TLSSkipVerify
 	}
 
+	if err := ssrf.CheckURL(r.Context(), repoURL); err != nil {
+		return httperror.BadRequest("Repository URL blocked by SSRF policy", err)
+	}
+
 	projectPath, err := handler.fileService.GetTemporaryPath()
 	if err != nil {
 		return httperror.InternalServerError("Unable to create temporary folder", err)

api/http/handler/gitops/sources/create_git.go

@@ -12,6 +12,7 @@ import (
 	httperror "github.com/portainer/portainer/pkg/libhttp/error"
 	"github.com/portainer/portainer/pkg/libhttp/request"
 	"github.com/portainer/portainer/pkg/libhttp/response"
+	"github.com/portainer/portainer/pkg/validate"
 )
 
 // GitAuthenticationPayload holds authentication parameters for a git source
@@ -30,8 +31,8 @@ type GitSourceCreatePayload struct {
 
 // Validate implements the portainer.Validatable interface
 func (payload *GitSourceCreatePayload) Validate(_ *http.Request) error {
-	if strings.TrimSpace(payload.URL) == "" {
-		return errors.New("url is required")
+	if !validate.IsURL(payload.URL) {
+		return errors.New("invalid repository URL. Must correspond to a valid URL format")
 	}
 
 	return nil

api/http/handler/gitops/sources/update_git.go

@@ -12,6 +12,7 @@ import (
 	httperror "github.com/portainer/portainer/pkg/libhttp/error"
 	"github.com/portainer/portainer/pkg/libhttp/request"
 	"github.com/portainer/portainer/pkg/libhttp/response"
+	"github.com/portainer/portainer/pkg/validate"
 )
 
 var (
@@ -35,6 +36,10 @@ type GitAuthenticationUpdatePayload struct {
 
 // Validate implements the portainer.Validatable interface
 func (payload *GitSourceUpdatePayload) Validate(_ *http.Request) error {
+	if payload.URL != nil && !validate.IsURL(*payload.URL) {
+		return errors.New("invalid repository URL. Must correspond to a valid URL format")
+	}
+
 	return nil
 }