fix[backend](threat_intelligense): added header injection protection and sanitized id on proxy requests

Author: AlexSanchez-bit

backend/modules/threatintel/handler/proxy.go

@@ -5,7 +5,9 @@ import (
 	"io"
 	"net/http"
 	"net/http/httputil"
+	"net/textproto"
 	"net/url"
+	"time"
 
 	"github.com/gin-gonic/gin"
 	"github.com/utmstack/utmstack/backend/modules/threatintel/internal"
@@ -96,19 +98,35 @@ func (h *ReverseProxyHandler) HandleUsageEndpoint(c *gin.Context) {
 		return
 	}
 
+	allowed := map[string]struct{}{
+		"Accept":                    {},
+		"Content-Type":              {},
+		"Content-Length":            {},
+		"User-Agent":                {},
+		"X-Request-Id":              {},
+		"X-Correlation-Id":          {},
+	}
+
 	// Copy headers
 	for k, v := range c.Request.Header {
 		if k != "Authorization" && k != "Id" && k != "Key" {
 			req.Header[k] = v
 		}
+		canonical := textproto.CanonicalMIMEHeaderKey(k)
+		if _, ok := allowed[canonical]; !ok {
+			continue
+		}
+		req.Header[k] = v
 	}
 
 	// Set instance credentials
 	req.Header.Set("id", cfg.InstanceID)
 	req.Header.Set("key", cfg.InstanceKey)
 
 	// Execute request
-	client := &http.Client{}
+	client := &http.Client{
+		Timeout: 20* time.Second,
+	}
 	resp, err := client.Do(req)
 	if err != nil {
 		c.JSON(http.StatusBadGateway, gin.H{"error": "upstream service error"})

backend/modules/threatintel/internal/instanceconfig.go

@@ -5,6 +5,7 @@ import (
 	"path/filepath"
 	"sync"
 
+	"github.com/threatwinds/go-sdk/catcher"
 	"gopkg.in/yaml.v3"
 )
 
@@ -31,6 +32,7 @@ func LoadInstanceConfig(updatesDir string) (*InstanceConfig, error) {
 		}
 		var cfg InstanceConfig
 		if err := yaml.Unmarshal(data, &cfg); err != nil {
+			_ = catcher.Error("error loading instance configuration",err,map[string]any{})
 			return
 		}
 		instanceConfig = &cfg

backend/modules/threatintel/routes.go

@@ -1,6 +1,8 @@
 package threatintel
 
 import (
+	"strings"
+
 	"github.com/gin-gonic/gin"
 	"github.com/utmstack/utmstack/backend/modules/threatintel/handler"
 )
@@ -15,7 +17,9 @@ func RegisterRoutes(api *gin.RouterGroup, m *Module, userAuth gin.HandlerFunc) {
 	// GET /api/v1/threat-intel/entity/:id → /proxy/api/analytics/v1/entity/{id}/details
 	g.GET("/entity/:id", func(c *gin.Context) {
 		id := c.Param("id")
-		targetPath := "/proxy/api/analytics/v1/entity/" + id + "/details"
+		replacer := strings.NewReplacer(".", "", "\\", "","/","")
+		sanitized_id := replacer.Replace(id)
+		targetPath := "/proxy/api/analytics/v1/entity/" + sanitized_id + "/details"
 		h := handler.NewReverseProxyHandler(targetPath)
 		h.Handle(c)
 	})