akanealw/Charon
1
0
Fork 0
Code Issues Pull Requests Actions 6 Packages Projects Releases Wiki Activity

fix: enhance CodeQL custom model for SSRF protection clarity and update URL validation comments

Browse Source
This commit is contained in:
GitHub Actions
2026-01-01 03:29:38 +00:00
parent 5ed998a9c4
commit f8667bcc66
2 changed files with 26 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/internal/utils/url_testing.go
+1 -10
View File
@@ -271,17 +271,8 @@ func TestURLConnectivity(rawURL string, transport ...http.RoundTripper) (reachab
// DNS resolution with private IP blocking (RFC 1918, loopback, link-local, metadata)
// 2. ssrfSafeDialer() re-validates IPs at connection time (prevents DNS rebinding/TOCTOU)
// 3. validateRedirectTarget() validates all redirect URLs in production
// 4. requestURL is derived from validated sources (breaks taint chain):
// - Production: security.ValidateExternalURL() returns new validated string
// - Test: url.Parse().String() reconstructs URL (mock transport, no network)
// 4. safeURL is constructed from parsed/validated components (breaks taint chain)
// See: internal/security/url_validator.go, internal/network/safeclient.go
//
// codeql[go/request-forgery] Safe: URL validated by security.ValidateExternalURL() which:
// 1. Validates URL format and scheme (HTTPS required in production)
// 2. Resolves DNS and blocks private/reserved IPs (RFC 1918, loopback, link-local)
// 3. Uses ssrfSafeDialer for connection-time IP revalidation (TOCTOU protection)
// 4. Redirect targets validated by validateRedirectTarget()
// lgtm[go/request-forgery]
resp, err := client.Do(req) //nolint:bodyclose // Body closed via defer below
latency = time.Since(start).Seconds() * 1000 // Convert to milliseconds