Potential fix for pull request finding 'CodeQL / Server-side request forgery'

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Author: venkateshsakamuri-lab

backend/src/main/java/com/dbaagent/service/S3LogFetchService.java

@@ -186,11 +186,27 @@ private AwsCredentialsProvider resolveCredentialsProvider(AwsCredentialsInput cr
 
     private static final int MAX_PRESIGNED_REDIRECTS = 5;
 
+    private boolean isAllowedPresignedHost(String host) {
+        if (host == null || host.isBlank()) {
+            return false;
+        }
+        String normalized = host.toLowerCase(java.util.Locale.ROOT);
+        return normalized.equals("s3.amazonaws.com")
+            || normalized.endsWith(".s3.amazonaws.com")
+            || normalized.matches(".*\\.s3\\.[a-z0-9-]+\\.amazonaws\\.com")
+            || normalized.matches(".*\\.s3-[a-z0-9-]+\\.amazonaws\\.com")
+            || normalized.equals("s3.amazonaws.com.cn")
+            || normalized.endsWith(".s3.amazonaws.com.cn")
+            || normalized.matches(".*\\.s3\\.[a-z0-9-]+\\.amazonaws\\.com\\.cn")
+            || normalized.matches(".*\\.s3-[a-z0-9-]+\\.amazonaws\\.com\\.cn");
+    }
+
     /**
      * Validates and rebuilds a presigned fetch URL: https only, to a public
-     * address. Returns a URI reconstructed from checked components rather than
-     * the input, so no unvalidated part of the caller's string survives into
-     * the request (java/ssrf). The initial URL and every redirect hop pass here.
+     * address, and restricted to known S3 endpoint host patterns. Returns a URI
+     * reconstructed from checked components rather than the input, so no
+     * unvalidated part of the caller's string survives into the request
+     * (java/ssrf). The initial URL and every redirect hop pass here.
      */
     private URI assertFetchableUrl(URI uri) {
         String scheme = uri.getScheme();
@@ -202,6 +218,9 @@ private URI assertFetchableUrl(URI uri) {
         if (host == null || host.isBlank()) {
             throw new IllegalArgumentException("Presigned log URL has no host");
         }
+        if (!isAllowedPresignedHost(host)) {
+            throw new IllegalArgumentException("Presigned log URL host is not an allowed S3 endpoint");
+        }
         java.net.InetAddress blocked =
             OutboundHostGuard.findBlockedAddress(OutboundHostGuard.normalize(host));
         if (blocked != null) {