fix[backend](threat_intelligense): added header injection protection and sanitized id on proxy requests

Author: AlexSanchez-bit

backend/modules/threatintel/handler/proxy.go

@@ -5,7 +5,9 @@ import (
 	"io"
 	"net/http"
 	"net/http/httputil"
+	"net/textproto"
 	"net/url"
+	"time"
 
 	"github.com/gin-gonic/gin"
 	"github.com/utmstack/utmstack/backend/modules/threatintel/internal"
@@ -96,10 +98,21 @@ func (h *ReverseProxyHandler) HandleUsageEndpoint(c *gin.Context) {
 		return
 	}
 
+	allowed := map[string]struct{}{
+		"Accept":                    {},
+		"Content-Type":              {},
+		"User-Agent":                {},
+		"X-Request-Id":              {},
+		"X-Correlation-Id":          {},
+	}
+
 	// Copy headers
-	for k, v := range c.Request.Header {
-		if k != "Authorization" && k != "Id" && k != "Key" {
-			req.Header[k] = v
+	for k, values := range c.Request.Header {
+		canonical := textproto.CanonicalMIMEHeaderKey(k)
+		if _, ok := allowed[canonical]; ok {
+			for _, v := range values {
+				req.Header.Add(canonical, v)
+			}
 		}
 	}
 
@@ -108,7 +121,9 @@ func (h *ReverseProxyHandler) HandleUsageEndpoint(c *gin.Context) {
 	req.Header.Set("key", cfg.InstanceKey)
 
 	// Execute request
-	client := &http.Client{}
+	client := &http.Client{
+		Timeout: 20* time.Second,
+	}
 	resp, err := client.Do(req)
 	if err != nil {
 		c.JSON(http.StatusBadGateway, gin.H{"error": "upstream service error"})

backend/modules/threatintel/internal/instanceconfig.go

@@ -5,6 +5,7 @@ import (
 	"path/filepath"
 	"sync"
 
+	"github.com/threatwinds/go-sdk/catcher"
 	"gopkg.in/yaml.v3"
 )
 
@@ -27,10 +28,12 @@ func LoadInstanceConfig(updatesDir string) (*InstanceConfig, error) {
 	configOnce.Do(func() {
 		data, err := os.ReadFile(filepath.Join(updatesDir, "instance-config.yml"))
 		if err != nil {
+			_ = catcher.Error("error loading instance configuration",err,map[string]any{})
 			return
 		}
 		var cfg InstanceConfig
 		if err := yaml.Unmarshal(data, &cfg); err != nil {
+			_ = catcher.Error("error loading instance configuration",err,map[string]any{})
 			return
 		}
 		instanceConfig = &cfg

backend/modules/threatintel/routes.go

@@ -1,6 +1,8 @@
 package threatintel
 
 import (
+	"strings"
+
 	"github.com/gin-gonic/gin"
 	"github.com/utmstack/utmstack/backend/modules/threatintel/handler"
 )
@@ -15,15 +17,15 @@ func RegisterRoutes(api *gin.RouterGroup, m *Module, userAuth gin.HandlerFunc) {
 	// GET /api/v1/threat-intel/entity/:id → /proxy/api/analytics/v1/entity/{id}/details
 	g.GET("/entity/:id", func(c *gin.Context) {
 		id := c.Param("id")
-		targetPath := "/proxy/api/analytics/v1/entity/" + id + "/details"
+		targetPath := "/proxy/api/analytics/v1/entity/" + sanitizeId(id) + "/details"
 		h := handler.NewReverseProxyHandler(targetPath)
 		h.Handle(c)
 	})
 
 	// GET /api/v1/threat-intel/entity/:id/relations → /proxy/api/analytics/v1/entity/{id}/relations
 	g.GET("/entity/:id/relations", func(c *gin.Context) {
 		id := c.Param("id")
-		targetPath := "/proxy/api/analytics/v1/entity/" + id + "/relations"
+		targetPath := "/proxy/api/analytics/v1/entity/" + sanitizeId(id) + "/relations"
 		h := handler.NewReverseProxyHandler(targetPath)
 		h.Handle(c)
 	})
@@ -40,3 +42,8 @@ func RegisterRoutes(api *gin.RouterGroup, m *Module, userAuth gin.HandlerFunc) {
 	usageHandler := handler.NewReverseProxyHandler("/proxy/usage")
 	g.GET("/usage", usageHandler.HandleUsageEndpoint)
 }
+
+func sanitizeId(id string) string{
+	replacer := strings.NewReplacer(".", "", "\\", "","/","")
+	return replacer.Replace(id)
+}