🛡️ Sentinel: [HIGH] Fix SSRF vulnerability in plugin download endpoints

[mttmcknn]

🚨 Severity: HIGH
💡 Vulnerability: The application used http.Get for downloading plugins from user-controlled URLs without validating the resolved IP address, making it vulnerable to Server-Side Request Forgery (SSRF) attacks. It also lacked a timeout configuration, exposing it to potential resource exhaustion (Denial of Service).
🎯 Impact: An attacker could provide a URL pointing to internal or private endpoints (e.g., cloud metadata at 169.254.169.254), allowing them to probe internal network configurations or extract sensitive instance metadata.
🔧 Fix: Replaced http.Get calls in addScriptPlugin and addFromDirectURL with a custom secureHTTPClient(). This client utilizes a net.Dialer with a Control hook to evaluate the resolved IP address after DNS resolution but before the socket connects. This strictly blocks requests to the cloud metadata IP (169.254.169.254), preventing DNS rebinding and IP obfuscation bypasses. A 10-second request timeout and DisableKeepAlives: true were also added to prevent resource exhaustion and connection leaks.
✅ Verification:

• Run go test ./... to verify no regressions in functionality.
• Try downloading a plugin using an external URL mapping to 169.254.169.254. It will fail with the message SSRF blocked: access to cloud metadata IP is prohibited.

---

PR created automatically by Jules for task 16427151402226286602 started by @himattm

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.