Restrict file transfer URL scheme to http(s) (#392)

Signed-off-by: Denghui Dong <denghui.ddh@alibaba-inc.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Author: 3 people

server/src/main/java/org/eclipse/jifa/server/domain/dto/FileTransferRequest.java

@@ -197,7 +197,7 @@ public boolean isValid(FileTransferRequest request, ConstraintValidatorContext c
                     valid &= checkNotBlank(request.scpSourcePath, "scpSourcePath", context);
                 }
 
-                case URL -> valid &= checkNotBlank(request.url, "url", context);
+                case URL -> valid &= checkHttpUrl(request.url, "url", context);
 
                 case TEXT -> {
                     // TODO: should check file type
@@ -222,6 +222,35 @@ private boolean checkNotBlank(String value, String name, ConstraintValidatorCont
             return true;
         }
 
+        /**
+         * Ensures the value is a non-blank http(s) URL. Other schemes such as file, jar and ftp
+         * are rejected to prevent reading arbitrary local resources on the server host.
+         */
+        private boolean checkHttpUrl(String value, String name, ConstraintValidatorContext context) {
+            if (!checkNotBlank(value, name, context)) {
+                return false;
+            }
+
+            java.net.URL url;
+            try {
+                url = new java.net.URL(value);
+            } catch (java.net.MalformedURLException e) {
+                context.buildConstraintViolationWithTemplate("Only http and https URLs are supported")
+                       .addPropertyNode(name)
+                       .addConstraintViolation();
+                return false;
+            }
+
+            String protocol = url.getProtocol();
+            if (!("http".equalsIgnoreCase(protocol) || "https".equalsIgnoreCase(protocol)) || StringUtils.isBlank(url.getHost())) {
+                context.buildConstraintViolationWithTemplate("Only http and https URLs are supported")
+                       .addPropertyNode(name)
+                       .addConstraintViolation();
+                return false;
+            }
+            return true;
+        }
+
         private boolean checkTrue(String value, String name, ConstraintValidatorContext context) {
             if (StringUtils.isBlank(value)) {
                 context.buildConstraintViolationWithTemplate("{jakarta.validation.constraints.NotBlank.message}")

server/src/main/java/org/eclipse/jifa/server/service/impl/StorageServiceImpl.java

@@ -321,7 +321,14 @@ public StreamCopier.Listener file(String name, long size) {
     }
 
     private void transferByURL(FileTransferRequest request, Path destination, FileTransferListener listener) throws IOException {
-        URLConnection conn = new java.net.URL(request.getUrl()).openConnection();
+        java.net.URL url = new java.net.URL(request.getUrl());
+        String protocol = url.getProtocol();
+        // Only http(s) is allowed. Reject schemes such as file, jar, ftp, etc. to
+        // prevent reading arbitrary local files (or other resources) on the host.
+        Validate.isTrue(("http".equalsIgnoreCase(protocol) || "https".equalsIgnoreCase(protocol))
+                        && StringUtils.isNotBlank(url.getHost()),
+                        CommonErrorCode.ILLEGAL_ARGUMENT, "Only http and https URLs are supported");
+        URLConnection conn = url.openConnection();
         listener.fireTotalSize(Math.max(conn.getContentLengthLong(), 0));
         try (InputStream in = conn.getInputStream();
              OutputStream out = new FileOutputStream(destination.toFile())) {

server/src/test/java/org/eclipse/jifa/server/domain/dto/TestFileTransferRequest.java

@@ -124,11 +124,55 @@ public void test() {
         result = validator.validate(request);
         shouldBeIllegal(result, "url");
 
+        // Non http(s) schemes must be rejected to prevent local file disclosure (SSRF).
+        request = new FileTransferRequest();
+        request.setType(FileType.GC_LOG);
+        request.setMethod(FileTransferMethod.URL);
+        request.setUrl("file:///etc/passwd");
+        result = validator.validate(request);
+        shouldBeIllegal(result, "url");
+
+        request = new FileTransferRequest();
+        request.setType(FileType.GC_LOG);
+        request.setMethod(FileTransferMethod.URL);
+        request.setUrl("file://localhost/etc/passwd");
+        result = validator.validate(request);
+        shouldBeIllegal(result, "url");
+
+        request = new FileTransferRequest();
+        request.setType(FileType.GC_LOG);
+        request.setMethod(FileTransferMethod.URL);
+        request.setUrl("jar:file:/tmp/a.jar!/b");
+        result = validator.validate(request);
+        shouldBeIllegal(result, "url");
+
+        request = new FileTransferRequest();
+        request.setType(FileType.GC_LOG);
+        request.setMethod(FileTransferMethod.URL);
+        request.setUrl("ftp://example.org/data.txt");
+        result = validator.validate(request);
+        shouldBeIllegal(result, "url");
+
+        // A URL without a scheme is not a valid http(s) URL.
         request = new FileTransferRequest();
         request.setType(FileType.GC_LOG);
         request.setMethod(FileTransferMethod.URL);
         request.setUrl("url");
         result = validator.validate(request);
+        shouldBeIllegal(result, "url");
+
+        request = new FileTransferRequest();
+        request.setType(FileType.GC_LOG);
+        request.setMethod(FileTransferMethod.URL);
+        request.setUrl("http://example.org/data.txt");
+        result = validator.validate(request);
+        assertEquals(0, result.size());
+
+        request = new FileTransferRequest();
+        request.setType(FileType.GC_LOG);
+        request.setMethod(FileTransferMethod.URL);
+        request.setUrl("https://example.org/data.txt");
+        result = validator.validate(request);
         assertEquals(0, result.size());
     }