SA-4 SSRF protections implemented.

backend/app/services/mastodon_oauth.py

@@ -7,19 +7,17 @@ import json
 from secrets import token_urlsafe
 from urllib.parse import urlencode
 from urllib.error import HTTPError
-from urllib.request import Request, urlopen
+from urllib.request import Request
 from uuid import uuid4
 
 from backend.app.core.config import settings
 from backend.app.database import get_connection
 from backend.app.services.secret_store import decrypt_secret, encrypt_secret
+from backend.app.services.mastodon_security import open_no_redirect, validate_public_instance
 
 
 def normalize_instance(instance: str) -> str:
-    value = instance.strip().rstrip('/')
-    if not value:
-        raise ValueError('Mastodon instance is required')
-    return value if '://' in value else f'https://{value}'
+    return validate_public_instance(instance)
 
 
 def post_form(url: str, values: dict) -> dict:
@@ -29,7 +27,7 @@ def post_form(url: str, values: dict) -> dict:
         headers={'Content-Type': 'application/x-www-form-urlencoded'},
         method='POST',
     )
-    with urlopen(request, timeout=10) as response:
+    with open_no_redirect(request, timeout=10) as response:
         return json.loads(response.read().decode('utf-8'))