Security fixes.

backend/src/Squidex.Domain.Apps.Entities/Backup/BackupOptions.cs

@@ -0,0 +1,13 @@
+// ==========================================================================
+//  Squidex Headless CMS
+// ==========================================================================
+//  Copyright (c) Squidex UG (haftungsbeschraenkt)
+//  All rights reserved. Licensed under the MIT license.
+// ==========================================================================
+
+namespace Squidex.Domain.Apps.Entities.Backup;
+
+public sealed class BackupOptions
+{
+    public bool AllowRestoreFromLocalFiles { get; set; }
+}

backend/src/Squidex.Domain.Apps.Entities/Backup/TempFolderBackupArchiveLocation.cs

@@ -12,7 +12,11 @@ using Squidex.Infrastructure.Json;
 namespace Squidex.Domain.Apps.Entities.Backup;
 
 [ExcludeFromCodeCoverage]
-public sealed class TempFolderBackupArchiveLocation(IJsonSerializer serializer, IHttpClientFactory httpClientFactory) : IBackupArchiveLocation
+public sealed class TempFolderBackupArchiveLocation(
+    IJsonSerializer serializer,
+    IOptions<BackupOptions> options,
+    IHttpClientFactory httpClientFactory) 
+    : IBackupArchiveLocation
 {
     public async Task<IBackupReader> OpenReaderAsync(Uri url, DomainId id,
         CancellationToken ct)

backend/src/Squidex/Areas/Api/Config/AssetFileResolver.cs

@@ -85,7 +85,7 @@ public class AssetFileResolver(IAssetUsageTracker assetUsage, IUsageGate usageGa
 
         try
         {
-            using var httpClient = httpClientFactory.CreateClient();
+            using var httpClient = httpClientFactory.CreateClient("Assets");
             using var httpResponse = await httpClient.GetAsync(fileUrl, ct);
 
             var length = httpResponse.Content.Headers.ContentLength;

backend/src/Squidex/Config/Domain/AssetServices.cs

@@ -12,6 +12,7 @@ using Squidex.Domain.Apps.Entities.Assets.Queries.Steps;
 using Squidex.Domain.Apps.Entities.History;
 using Squidex.Domain.Apps.Entities.Search;
 using Squidex.Infrastructure.EventSourcing;
+using Squidex.Infrastructure.Http;
 
 namespace Squidex.Config.Domain;
 
@@ -34,6 +35,9 @@ public static class AssetServices
                .As<IEventConsumer>();
         }
 
+        services.AddHttpClient("Assets")
+            .EnableSsrfProtection();
+
         services.AddSingletonAs<AssetQueryParser>()
             .AsSelf();
 

backend/src/Squidex/Config/Domain/BackupsServices.cs

@@ -12,15 +12,16 @@ using Squidex.Domain.Apps.Entities.Backup;
 using Squidex.Domain.Apps.Entities.Contents;
 using Squidex.Domain.Apps.Entities.Rules;
 using Squidex.Domain.Apps.Entities.Schemas;
-using Squidex.Flows;
-using Squidex.Infrastructure.Reflection;
 
 namespace Squidex.Config.Domain;
 
 public static class BackupsServices
 {
-    public static void AddSquidexBackups(this IServiceCollection services)
+    public static void AddSquidexBackups(this IServiceCollection services, IConfiguration config)
     {
+        services.Configure<BackupOptions>(config,
+            "backups");
+
         services.AddHttpClient("Backup", options =>
         {
             options.Timeout = TimeSpan.FromHours(1);

backend/src/Squidex/Config/Domain/InfrastructureServices.cs

@@ -21,6 +21,7 @@ using Squidex.Domain.Apps.Entities.Contents.Counter;
 using Squidex.Domain.Apps.Entities.Tags;
 using Squidex.Infrastructure;
 using Squidex.Infrastructure.Diagnostics;
+using Squidex.Infrastructure.Http;
 using Squidex.Infrastructure.Log;
 using Squidex.Infrastructure.Translations;
 using Squidex.Infrastructure.UsageTracking;
@@ -45,7 +46,8 @@ public static class InfrastructureServices
         services.Configure<DiagnoserOptions>(config,
             "diagnostics");
 
-        services.AddHttpClient("Jint");
+        services.AddHttpClient("Jint")
+            .EnableSsrfProtection();
 
         services.AddReplicatedCache();
         services.AddAsyncLocalCache();

backend/src/Squidex/appsettings.json

@@ -101,6 +101,11 @@
         "allowAutoRedirect": false
     },
 
+    "backups": {
+        // Enables to download backups from the local file system.
+        "allowRestoreFromLocalFiles": false
+    },
+
     "caching": {
         // Set to true, to use strong etags.
         "strongETag": false,