fix: [sourcecache] validate URLs before archiving to block SSRF

[elhoim]

The sourcecache expansion module passes the attacker-controlled link/url attribute straight to the archiver with no validation:

if request.get("link"):
    tocache = request["link"]
    data = __archiveLink(archive_path, tocache)
    mispattributes["output"] = ["attachment"]
elif request.get("url"):
    tocache = request["url"]
    data = __archiveLink(archive_path, tocache)
    mispattributes["output"] = ["malware-sample"]

__archiveLink hands this value directly to url_archiver.Archive.fetch(). Since MISP users routinely enrich attacker-supplied link/url attributes, this lets a malicious event trigger a server-side request to any URL the MISP instance can reach — e.g. http://127.0.0.1:6379/, cloud metadata endpoints, or other internal-only services — and the fetched response is stored back into MISP as a cached attachment, effectively an SSRF-to-data-exfiltration primitive reachable by enriching a hostile attribute.

Impact

An analyst who runs the sourcecache module on an attribute from an untrusted event can unknowingly cause the MISP server to reach internal-only services and have the response persisted into the event as an "attachment" or "malware-sample" attribute, disclosing internal service data through the MISP UI.

Fix

Added an is_safe_url() check — scheme must be http/https and the hostname must resolve only to globally-routable IPs (via ipaddress.is_global) — mirroring the hardened validation already used in qrcode.py. The module now returns a "Blocked URL" misperror instead of fetching when the check fails; no other behaviour changes.

Verification

• flake8 (run from the worktree root so pyproject.toml's [tool.flake8] extend-ignore applies): clean, no warnings on the changed file.
• Full module test suite: 161 passed, 4 skipped, 5 subtests passed in 24.90s.

Found during a review of the repository; other findings are being submitted as separate PRs.

🤖 Generated with Claude Code

https://claude.ai/code/session_018dfYpyaSZd1nxSRLr8suj8