From fa55c0fb6eb5f8021d23218d7c1251077e6ebe61 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=89mile=20R=C3=A9?= Date: Tue, 12 May 2026 10:29:19 +0400 Subject: [PATCH] Fix SSRF protection bypass in common-third-parties-import MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The HTTP transport was replaced after WithSSRFProtection() was applied, discarding the protected dialer. Wrap the existing transport with userAgentTransport instead of replacing it. Signed-off-by: Émile Ré --- cmd/common-third-parties-import/main.go | 22 ++-------------------- 1 file changed, 2 insertions(+), 20 deletions(-) diff --git a/cmd/common-third-parties-import/main.go b/cmd/common-third-parties-import/main.go index 079a1a92a..ad1661eab 100644 --- a/cmd/common-third-parties-import/main.go +++ b/cmd/common-third-parties-import/main.go @@ -25,7 +25,6 @@ package main import ( "bytes" "context" - "crypto/tls" "encoding/json" "flag" "fmt" @@ -234,27 +233,10 @@ func fetchAndStoreLogos( ) error { s3Client := newS3Client(endpoint, region, accessKey, secretKey, usePathStyle) fileMgr := filemanager.NewService(s3Client) - tlsConfig := &tls.Config{ - CipherSuites: []uint16{ - tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, - tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, - tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, - tls.TLS_AES_128_GCM_SHA256, - tls.VersionTLS13, - tls.VersionTLS10, - }, - } httpClient := httpclient.DefaultPooledClient(httpclient.WithSSRFProtection()) httpClient.Transport = &userAgentTransport{ - next: &http.Transport{ - TLSHandshakeTimeout: 30 * time.Second, - DisableKeepAlives: false, - TLSClientConfig: tlsConfig, - DialTLS: func(network, addr string) (net.Conn, error) { - return tls.Dial(network, addr, tlsConfig) - }, - }, - ua: version.UserAgent("common-third-parties-import"), + next: httpClient.Transport, + ua: version.UserAgent("common-third-parties-import"), } scope := coredata.NewScope(gid.NilTenant)