fix(ssrf): fix URL parsing BE-13121 (#3011)

pkg/libhttp/ssrf/ssrf.go

@@ -98,7 +98,12 @@ func CheckURL(ctx context.Context, rawURL string) error {
 		return nil
 	}
 
-	u, err := url.Parse(rawURL)
+	normalized := rawURL
+	if !strings.Contains(normalized, "://") && !strings.HasPrefix(normalized, "//") {
+		normalized = "//" + normalized
+	}
+
+	u, err := url.Parse(normalized)
 	if err != nil {
 		return fmt.Errorf("ssrf: invalid URL %q: %w", rawURL, err)
 	}

pkg/libhttp/ssrf/ssrf_test.go

@@ -224,6 +224,40 @@ func TestCheckURL(t *testing.T) {
 			url:     "http://",
 			wantErr: false,
 		},
+		{
+			name:    "scheme-less IP:port SSRF disabled",
+			mode:    portainer.SSRFModeOff,
+			url:     "10.10.1.41:30775",
+			wantErr: false,
+		},
+		{
+			name:    "scheme-less IP:port blocked",
+			mode:    portainer.SSRFModeEnforce,
+			entries: []string{"8.8.8.0/24"},
+			url:     "10.10.1.41:30775",
+			wantErr: true,
+		},
+		{
+			name:    "scheme-less IP:port allowed by CIDR",
+			mode:    portainer.SSRFModeEnforce,
+			entries: []string{"10.10.1.0/24"},
+			url:     "10.10.1.41:30775",
+			wantErr: false,
+		},
+		{
+			name:    "git scheme IP blocked",
+			mode:    portainer.SSRFModeEnforce,
+			entries: []string{"8.8.8.0/24"},
+			url:     "git://10.10.1.41:9418/",
+			wantErr: true,
+		},
+		{
+			name:    "git scheme IP allowed by CIDR",
+			mode:    portainer.SSRFModeEnforce,
+			entries: []string{"10.10.1.0/24"},
+			url:     "git://10.10.1.41:9418/",
+			wantErr: false,
+		},
 	}
 
 	for _, tc := range tests {