veza/veza-backend-api/internal/validators/url_validator.go

package validators

import (
	"fmt"
	"net"
	"net/url"
	"strings"
)

// blockedHostnames contains hostnames that must never be used as webhook targets (SSRF protection).
var blockedHostnames = []string{
	"localhost",
	"127.0.0.1",
	"metadata",
	"metadata.google.internal",
	"metadata.google",
	"instance-data",
	"169.254.169.254",
}

// IsInternalOrPrivateURL returns true if the URL targets an internal or private address (SSRF risk).
// Blocks: localhost, 127.0.0.1, 10.x, 172.16-31.x, 192.168.x, 169.254.x (cloud metadata).
func IsInternalOrPrivateURL(rawURL string) bool {
	parsed, err := url.Parse(rawURL)
	if err != nil {
		return true // Invalid URL treated as unsafe
	}

	scheme := strings.ToLower(parsed.Scheme)
	if scheme != "http" && scheme != "https" {
		return true
	}

	hostname := strings.ToLower(parsed.Hostname())
	if hostname == "" {
		return true
	}

	for _, blocked := range blockedHostnames {
		if hostname == blocked {
			return true
		}
	}

	ips, err := net.LookupIP(hostname)
	if err != nil {
		return true // Resolution failure treated as unsafe
	}

	for _, ip := range ips {
		if isPrivateIP(ip) {
			return true
		}
	}
	return false
}

func isPrivateIP(ip net.IP) bool {
	privateRanges := []string{
		"10.0.0.0/8",     // RFC1918
		"172.16.0.0/12",  // RFC1918
		"192.168.0.0/16", // RFC1918
		"127.0.0.0/8",    // Loopback
		"169.254.0.0/16", // Link-local / cloud metadata
		"::1/128",        // IPv6 loopback
		"fc00::/7",       // IPv6 unique local
		"fe80::/10",      // IPv6 link-local
	}
	for _, cidrStr := range privateRanges {
		_, cidr, err := net.ParseCIDR(cidrStr)
		if err != nil {
			continue
		}
		if cidr.Contains(ip) {
			return true
		}
	}
	return false
}

// ValidateWebhookURL validates that a webhook URL is safe for registration.
// SEC-07: Only HTTPS allowed. Blocks private/internal IPs (SSRF protection).
func ValidateWebhookURL(rawURL string) error {
	parsed, err := url.Parse(rawURL)
	if err != nil {
		return fmt.Errorf("invalid URL: %w", err)
	}
	scheme := strings.ToLower(parsed.Scheme)
	if scheme != "https" {
		return fmt.Errorf("only https URLs are allowed for webhooks (got %q)", parsed.Scheme)
	}
	hostname := strings.ToLower(parsed.Hostname())
	if hostname == "" {
		return fmt.Errorf("URL must have a hostname")
	}
	if IsInternalOrPrivateURL(rawURL) {
		return fmt.Errorf("URL targets internal or private address - not allowed for webhooks")
	}
	return nil
}

// ValidateRedirectURL validates that a user-supplied redirect URL is
// safe for browser redirection. v1.0.10 sécu item 7 — open-redirect
// protection on Stripe Connect onboarding return_url, KYC return_url,
// and any future user-supplied callback that ends up in a Location
// header or Stripe redirect.
//
// Different from ValidateWebhookURL : the platform does NOT fetch this
// URL server-side (so no SSRF concern), but a user who submits
// `return_url=https://attacker.com/phishing` and gets a victim to
// click the resulting Stripe link will see the victim land on the
// attacker's page after Stripe completes. We require the host to
// match one of `allowedHosts` exactly OR be a subdomain of one of
// them.
//
// Empty allowedHosts ⇒ permissive : only checks that the URL parses
// and uses https. Used as a soft mode for dev / staging where the
// canonical hosts may not be set.
func ValidateRedirectURL(rawURL string, allowedHosts []string) error {
	parsed, err := url.Parse(rawURL)
	if err != nil {
		return fmt.Errorf("invalid URL: %w", err)
	}
	scheme := strings.ToLower(parsed.Scheme)
	if scheme != "https" && scheme != "http" {
		return fmt.Errorf("redirect URL must use http or https (got %q)", parsed.Scheme)
	}
	hostname := strings.ToLower(parsed.Hostname())
	if hostname == "" {
		return fmt.Errorf("URL must have a hostname")
	}

	// In production we want HTTPS only ; staging / dev may relax to
	// http for localhost / .local domains. The handler chooses the
	// allowedHosts list per-environment.
	if len(allowedHosts) == 0 {
		// Permissive mode (dev / unconfigured) — accept any
		// well-formed URL with a non-internal hostname.
		if IsInternalOrPrivateURL(rawURL) {
			return fmt.Errorf("redirect URL targets internal or private address")
		}
		return nil
	}

	for _, allowed := range allowedHosts {
		allowed = strings.ToLower(strings.TrimSpace(allowed))
		if allowed == "" {
			continue
		}
		if hostname == allowed {
			return nil
		}
		// Subdomain match : foo.veza.fr matches "veza.fr".
		if strings.HasSuffix(hostname, "."+allowed) {
			return nil
		}
	}
	return fmt.Errorf("redirect URL host %q is not in the allow-list", hostname)
}