fix(security): block SSRF in data resolver route

[olexii4]

What does this PR do?

Fixes an SSRF vulnerability in POST /dashboard/api/data/resolver that let any authenticated user proxy requests to internal addresses.

Root Cause

The route passed the caller-supplied URL directly to axios.get() with no host filtering. The operator allowlist (spec.devEnvironments.allowedSources.urls) existed in serverConfigApi but was never checked here, so loopback addresses, RFC-1918 ranges, and the cloud IMDS endpoint (169.254.169.254) were all reachable.

Fix

Two guards added to dataResolver.ts:

1. Private IP block — rejects requests to 127.x, localhost, ::1, 169.254.x, 10.x, 172.16–31.x, 192.168.x with 403 before making any outbound call.
2. Operator allowlist — when spec.devEnvironments.allowedSources.urls is set, the URL must match an entry (exact or wildcard). Empty list keeps the existing open behavior.

maxRedirects: 0 prevents bypass via redirect from an allowed host.

Also updated the Swagger example URL, which pointed to a private address and would now always return 403.

What issues does this PR fix or reference?

fixes https://redhat.atlassian.net/browse/CRW-11948

Is it tested? How?

Manual via Swagger:

1. Deploy Eclipse Che with the dashboard image from this PR.
2. Navigate to https://<che-host>/dashboard/swagger → Data Resolver → POST /dashboard/api/data/resolver → Try it out.
3. Submit — verify 403:

   { "url": "http://127.0.0.1:8080/dashboard/devfile-registry/devfiles/index.json" }

4. Submit — verify 200:

   { "url": "https://raw.githubusercontent.com/devfile-samples/devfile-sample-python-basic/main/devfile.yaml" }

Release Notes

Fixed an SSRF vulnerability in the data resolver endpoint that allowed authenticated users to reach internal network addresses.

Docs PR

N/A

[che-bot]

Click here to review and test in web IDE:

[github-actions]

Docker image build succeeded: quay.io/eclipse/che-dashboard:pr-1655 (linux/amd64, linux/arm64, linux/s390x)

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/dashboard/deployment", "value": {containers: [{image: "quay.io/eclipse/che-dashboard:pr-1655", name: che-dashboard}]}}]"

[github-actions]

Docker image build succeeded: quay.io/eclipse/che-dashboard:pr-1655 (linux/amd64, linux/arm64, linux/s390x)

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/dashboard/deployment", "value": {containers: [{image: "quay.io/eclipse/che-dashboard:pr-1655", name: che-dashboard}]}}]"

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: olexii4, svor

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[codecov]

Codecov Report

❌ Patch coverage is 90.90909% with 8 lines in your changes missing coverage. Please review.
✅ Project coverage is 92.56%. Comparing base (8d59ae9) to head (0ace377).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
...s/dashboard-backend/src/routes/api/dataResolver.ts	90.80%	8 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1655      +/-   ##
==========================================
- Coverage   92.56%   92.56%   -0.01%     
==========================================
  Files         596      596              
  Lines       61908    61995      +87     
  Branches     4874     4898      +24     
==========================================
+ Hits        57305    57384      +79     
- Misses       4541     4549       +8     
  Partials       62       62              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.