feat: filter integration connections on Phase Cloud

[nimish-ks]

🔍 Overview

This PR adds a network filtering utility that restricts the targets to which you can set up an integration on Phase Cloud. This provides a robust layer of protection against Server-Side Request Forgery (SSRF) by preventing the backend from making requests to internal, private, or reserved networks.

💡 Proposed Changes

• New Utility: Created backend/api/utils/network.py containing validate_url_is_safe and is_ip_private.
• Comprehensive Blacklist: Implemented BLOCKED_NETWORKS to filter out high-risk IP ranges:

BLOCKED_NETWORKS = [
    ipaddress.ip_network("100.64.0.0/10"), # Carrier Grade NAT (used by Tailscale, Alibaba Cloud metadata)
    ipaddress.ip_network("192.0.0.0/24"), # IETF Protocol Assignments
    ipaddress.ip_network("198.18.0.0/15"), # Network Benchmark
    ipaddress.ip_network("169.254.0.0/16"),  # Link-Local / Cloud Metadata
    ipaddress.ip_network("192.0.0.192/32"),  # Oracle Cloud Metadata
    ipaddress.ip_network("127.0.0.0/8"),     # Loopback
    ipaddress.ip_network("0.0.0.0/8"),       # Current network
    ipaddress.ip_network("240.0.0.0/4"),     # Reserved
    ipaddress.ip_network("::1/128"),         # IPv6 Loopback
    ipaddress.ip_network("fe80::/10"),       # IPv6 Link-Local
    ipaddress.ip_network("fc00::/7"),        # IPv6 Unique Local Address
    ipaddress.ip_network("224.0.0.0/4"),     # Multicast (IPv4)
    ipaddress.ip_network("ff00::/8"),        # Multicast (IPv6)
    ipaddress.ip_network("fec0::/10"),       # IPv6 Site-Local (Deprecated)
]

• Integration Points: Applied this validation to all areas where user-supplied URLs are used for outbound requests:
  • AWS External Identities: Validates stsEndpoint in CreateIdentityMutation and UpdateIdentityMutation.
  • AWS IAM Auth: Runtime safety check in aws_iam_auth view.
  • Vault Sync: Validates VAULT_ADDR.
  • Nomad Sync: Validates NOMAD_ADDR.
  • GitLab Sync: Validates the GitLab host URL for self-hosted instances.

📝 Release Notes

• Security Hardening: Added system-wide SSRF protection for integrations. All user-supplied integration hostnames/URLs are now validated against IANA-reserved and internal networks.
• Finding Ref: V15
• Severity: Medium

🧪 Testing

• Negative Tests: Verified that attempting to use internal IPs (e.g., 127.0.0.1, 169.254.169.254, 192.168.1.1) as integration endpoints results in a ValidationError.
• Positive Tests: Confirmed that standard public endpoints (e.g., sts.amazonaws.com, gitlab.com) continue to work correctly.
• Hostname Resolution: Verified that the utility correctly resolves hostnames to IPs before checking the blacklist.

🎯 Reviewer Focus

• backend/api/utils/network.py: Review the validate_url_is_safe logic and the list of blocked networks.
• Identity and Sync modules: Ensure the validation is placed correctly before network calls are initiated.

➕ Additional Context

Finding reported by kolega.dev. (only for AWS STS endpoint)

✨ How to Test the Changes Locally

1. Attempt to create an AWS External Identity via GraphQL with an stsEndpoint pointing to http://127.0.0.1:8000.
2. Attempt to configure a Vault Sync integration with a vault_addr pointing to an internal IP (e.g., http://10.0.0.5).
3. Verify that the UI/API returns an appropriate validation error: URL resolves to a restricted IP address.

💚 Did You...

• Ensure linting passes (code style checks)?
• Verify the app builds locally?
• Manually test the changes on different integrations?

[cursor]

You have run out of free Bugbot PR reviews for this billing cycle. This will reset on January 13.

To receive reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.