x509util: fix SSRF hostname bypass in rejectPrivateHost()

PR google#1761 introduced rejectPrivateHost() to block SSRF via
private IP addresses, but only checked net.ParseIP() which
returns nil for hostnames. DNS hostnames resolving to private
or loopback addresses bypassed the fix entirely.

This change resolves hostnames via net.LookupHost() before
IP validation, blocking bypasses such as:
  - localhost → 127.0.0.1 (loopback)
  - metadata.google.internal → 169.254.169.254 (GCP)
  - kubernetes.default.svc → 10.x.x.x (k8s)

Also adds:
  - rejectPrivateHost() to ReadFileOrURL() and GetIssuer()
  - defer rsp.Body.Close() to prevent resource leaks
  - Tests for hostname bypass and SSRF protection

Fixes incomplete fix in PR google#1761 (Issue google#1759)

Author: observatory

x509util/files.go

@@ -18,6 +18,7 @@ import (
 	"encoding/pem"
 	"fmt"
 	"io"
+	"net"
 	"net/http"
 	"net/url"
 	"os"
@@ -26,6 +27,38 @@ import (
 	"github.com/google/certificate-transparency-go/x509"
 )
 
+// rejectPrivateHost returns an error if the URL host resolves
+// to a loopback, link-local, or private IP address.
+func rejectPrivateHost(u *url.URL) error {
+	host := u.Hostname()
+	ip := net.ParseIP(host)
+	if ip == nil {
+		addrs, err := net.LookupHost(host)
+		if err != nil {
+			return fmt.Errorf("failed to resolve host %q: %v", host, err)
+		}
+		for _, addr := range addrs {
+			resolved := net.ParseIP(addr)
+			if resolved == nil {
+				continue
+			}
+			if resolved.IsLoopback() || resolved.IsLinkLocalUnicast() ||
+				resolved.IsLinkLocalMulticast() || resolved.IsPrivate() {
+				return fmt.Errorf(
+					"refusing URL: hostname %q resolves to private/loopback IP %q",
+					host, addr)
+			}
+		}
+		return nil
+	}
+	if ip.IsLoopback() || ip.IsLinkLocalUnicast() ||
+		ip.IsLinkLocalMulticast() || ip.IsPrivate() {
+		return fmt.Errorf(
+			"refusing to fetch URL with private/loopback host: %q", u.String())
+	}
+	return nil
+}
+
 // ReadPossiblePEMFile loads data from a file which may be in DER format
 // or may be in PEM format (with the given blockname).
 func ReadPossiblePEMFile(filename, blockname string) ([][]byte, error) {
@@ -45,10 +78,18 @@ func ReadPossiblePEMURL(target, blockname string) ([][]byte, error) {
 		return ReadPossiblePEMFile(target, blockname)
 	}
 
+	u, err := url.Parse(target)
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse URL %q: %v", target, err)
+	}
+	if err := rejectPrivateHost(u); err != nil {
+		return nil, err
+	}
 	rsp, err := http.Get(target)
 	if err != nil {
 		return nil, fmt.Errorf("failed to http.Get(%q): %v", target, err)
 	}
+	defer rsp.Body.Close()
 	data, err := io.ReadAll(rsp.Body)
 	if err != nil {
 		return nil, fmt.Errorf("failed to io.ReadAll(%q): %v", target, err)
@@ -84,10 +125,14 @@ func ReadFileOrURL(target string, client *http.Client) ([]byte, error) {
 		return os.ReadFile(target)
 	}
 
+	if err := rejectPrivateHost(u); err != nil {
+		return nil, err
+	}
 	rsp, err := client.Get(u.String())
 	if err != nil {
 		return nil, fmt.Errorf("failed to http.Get(%q): %v", target, err)
 	}
+	defer rsp.Body.Close()
 	return io.ReadAll(rsp.Body)
 }
 
@@ -99,6 +144,16 @@ func GetIssuer(cert *x509.Certificate, client *http.Client) (*x509.Certificate,
 		return nil, nil
 	}
 	issuerURL := cert.IssuingCertificateURL[0]
+	u, err := url.Parse(issuerURL)
+	if err != nil {
+		return nil, fmt.Errorf("invalid issuer URL %q: %v", issuerURL, err)
+	}
+	if u.Scheme != "http" && u.Scheme != "https" {
+		return nil, fmt.Errorf("unsupported scheme in issuer URL %q", issuerURL)
+	}
+	if err := rejectPrivateHost(u); err != nil {
+		return nil, err
+	}
 	rsp, err := client.Get(issuerURL)
 	if err != nil || rsp.StatusCode != http.StatusOK {
 		return nil, fmt.Errorf("failed to get issuer from %q: %v", issuerURL, err)

x509util/files_ssrf_test.go

@@ -0,0 +1,58 @@
+package x509util
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+)
+
+func TestRejectPrivateHost(t *testing.T) {
+	tests := []struct {
+		url     string
+		wantErr bool
+	}{
+		{"http://169.254.169.254/latest/meta-data/", true},
+		{"http://127.0.0.1/secret", true},
+		{"http://192.168.1.1/admin", true},
+		{"http://10.0.0.1/internal", true},
+		{"http://[::1]/secret", true},
+		{"http://localhost/secret", true},
+		{"http://example.com/public", false},
+		{"http://8.8.8.8/dns", false},
+	}
+
+	for _, tt := range tests {
+		u, _ := url.Parse(tt.url)
+		err := rejectPrivateHost(u)
+		if (err != nil) != tt.wantErr {
+			t.Errorf("rejectPrivateHost(%q) error=%v wantErr=%v",
+				tt.url, err, tt.wantErr)
+		}
+	}
+}
+
+func TestReadFileOrURL_SSRFBypass(t *testing.T) {
+	srv := httptest.NewServer(
+		http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			w.Write([]byte("SECRET_INTERNAL_DATA"))
+		}))
+	defer srv.Close()
+
+	client := &http.Client{}
+	localhostURL := "http://localhost:" + 
+		srv.Listener.Addr().String()[len("127.0.0.1:"):]  + "/secret"
+
+	_, err := ReadFileOrURL(localhostURL, client)
+	if err == nil {
+		t.Errorf("ReadFileOrURL should reject localhost URL: %s", localhostURL)
+	}
+}
+
+func TestReadFileOrURL_PublicURL(t *testing.T) {
+	client := &http.Client{}
+	_, err := ReadFileOrURL("https://example.com/", client)
+	if err != nil {
+		t.Skipf("network unavailable: %v", err)
+	}
+}