[nabramovitz]

Batches two security-findings fixes surfaced by the scanner baseline.

1. SSRF guard on operator-supplied fetch URLs

Two backend endpoints fetch a URL taken from the request using the
standard http client:

• GET /pp/v1/kube/cert (kubernetes/main.go RequiresCert) — probes a
  Kube API URL to see whether it needs a client cert.
• Helm chart download (kubernetes/install_release.go loadChart).

Both are admin-gated, but a Stratos admin is not necessarily an infra
admin: pointing either at http://169.254.169.254/ or a loopback
service lets the backend read the host's cloud metadata / IAM
credentials — an SSRF escalation.

Fix adds GetGuardedHttpClient, a client whose dialer rejects loopback
and link-local addresses through a net.Dialer.Control hook. The check
runs on the resolved IP at dial time, so DNS rebinding cannot slip a
blocked address past it. Private RFC1918 ranges stay allowed because
Kubernetes API servers legitimately live there. Both sinks route through
it and validate/normalise the URL first (require an http(s) scheme and
host; join the path instead of string concatenation).

Closes the two go/request-forgery CodeQL alerts. A third
(authuaa.go) is admin-configured endpoint metadata rather than request
input and is left for a separate dismissal.

2. Patched build-chain deps via devkit overrides

Force patched transitive versions through devkit's npm overrides to
clear the frontend Dependabot alerts against its package-lock:

Package	Before	After	Line
undici	7.24.4	7.28.0	—
vite	7.3.2	7.3.5	—
webpack-dev-server	5.2.3	5.2.5	—
piscina	5.1.4	5.2.0	—
@babel/core	7.29.0	7.29.6	—
http-proxy-middleware	3.0.5	3.0.7	v3 (CRLF-injection fix)
http-proxy-middleware	2.0.9	2.0.10	v2, scoped under webpack-dev-server

All are dev-server / build-chain tooling that never ships to runtime.
esbuild and uuid are left unchanged: esbuild's fix (0.28.x) is outside
vite's esbuild@^0.27.0 range, and uuid's fix (11.x) is a major jump
sockjs (peer ^8.3.2) will not accept. Both clear once those
upstreams widen.

3. Kubernetes plugin build fix

The plugin module pinned spf13/cobra to v0.0.3 via a replace directive
from the 2019 Helm 3 migration, which predates the cobra API that
k8s.io/kubectl v0.35.1 now requires — so the module no longer compiled.
Removed the stale replace so cobra resolves to the v1.10.2 already
required by the graph. Our code does not use cobra directly (it enters
only through helm/kubectl internals). This also lets the SSRF plugin
changes above actually compile.

4. cfapppush path traversal in folder/file upload

The deploy websocket's folder/file source handler joined client-supplied
folder names and file paths straight onto the temp upload dir, so a
message like ../../../home/vcap/app/x escaped the sandbox — os.Mkdir
created dirs and os.WriteFile wrote attacker-controlled content outside
tempDir, as the backend (vcap) user, before any Cloud Foundry
authorization check. Reachable by any authenticated Stratos user.

Added safeUploadJoin, which rejects non-local names (filepath.IsLocal)
before joining — the same guard #5620 applied to archive extraction in
unarchive.go, which never covered this separate upload loop. Both the
folder-create and file-write sinks route through it; legitimate nested
paths still pass. Unit test covers traversal rejection and nested-path
acceptance.

Closes the two go/path-injection CodeQL alerts in deploy.go (297,
338). The remaining path-injection alerts (monocular, analysis/container)
are triaged separately: most are not exploitable, and the few real ones
are lower-urgency (a hostile registered Helm repo; a tech-preview-gated
sidecar).

5. monocular chart-cache path traversal

The chart cache folder joined chart Name, Version and EndpointID
straight onto the cache dir. Name/Version come from an external Helm
repository's index.yaml, so a hostile registered repo could set a name
like ../../.. and make the sync worker write the digest, create
directories, save the downloaded icon, and extract archive files outside
the cache — as the backend user. Add safeSegment and apply it to all
three components at the single choke point getChartCacheFolder, so
every cache sink is confined. Legitimate names/versions/GUIDs are
unchanged. Closes the four go/path-injection alerts in cache.go (119,
168, 260, 312).

6. analysis container report-path traversal

The analysis container service built filesystem paths from its HTTP route
parameters (user/endpoint/id/file) and the X-Stratos-Analaysis-ID
header without traversal checks, so a ../.. value escaped reportsDir:
report served an arbitrary *.json, delete/deleteEndpoint ran
os.RemoveAll on an arbitrary directory, and the run handler wrote report
files outside the tree. The container has no auth of its own (it is
intended as a tech-preview-gated sidecar), so this is reachable by anyone
who can reach its port. Add validateSegment for the single-segment route
params and reject a non-local ID header with filepath.IsLocal (the
header seeds job.Folder, which the kubescore/popeye analyzers write
into). Mirrors the existing validateContentID/validateNamespace
guards. Closes the go/path-injection alerts in routes.go (39, 50, 71),
run.go (44), kubescore.go (58, 62) and popeye.go (73, 77).

7. Code Quality (CodeQL correctness) alerts

Clears the remaining CodeQL Code Quality list beyond the incomplete-sanitization fixes above:

• js/incomplete-url-substring-sanitization (kube-config-auth.helper.ts 71, 112) — provider detection used server.indexOf('azmk8s.io'|'eks.amazonaws.com'), which matches the domain anywhere in the URL. Replaced with serverHostEndsWith, a hostname-suffix check. Only the provider label is affected, but the match is now correct.
• js/shell-command-injection-from-environment (build-orchestrator.js 130, post-setup.cjs 24) — two build helpers interpolated paths into shell strings for execSync. Switched to execFileSync with an argv array (plus fs.renameSync for the .js/.cjs shuffle), removing the shell. Build-only tooling with trusted input, but it removes the injection-shaped pattern.

With the incomplete-sanitization fixes, all 7 correctness-tagged Code Quality alerts are addressed.

Verification

• cfapppush + core jetstream modules build; guardedDialControl and safeUploadJoin unit tests pass
  (blocks loopback / link-local / metadata / unparseable, allows public
  and RFC1918).
• bun run build-devkit builds clean; npm audit on devkit drops to the
  two upstream-blocked advisories above.

Notes for reviewers

• Dependabot scans devkit's package-lock.json but not the root
  bun.lock, so the same patched-vs-vulnerable versions also exist,
  unreported, in the root tree. Folding devkit into the root bun
  workspace (possible once it moves off Angular 21 onto 22 like the rest
  of the repo) is the follow-up that removes the duplicate npm island.
• Pre-existing lint (not fixed here, does not block CI): go test ./...
  on the kubernetes plugin module reports several go vet
  non-constant-format-string warnings in helm_client.go,
  kube_dashboard.go and install_release.go:113. CI compiles the
  plugin via extra_plugins.go rather than running its module tests, so
  these do not gate — worth a separate cleanup.

[norman-abramovitz]

lgtm