🛡️ Sentinel: [HIGH] Fix SSRF vulnerability in S3 connection test endpoint_url

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

tests/test_api_integrations.py

@@ -1011,6 +1011,45 @@ class TestConnectionTestEndpoint:
         assert data["success"] is False
         assert "bucket" in data["message"].lower()
 
+    def test_test_s3_blocks_private_ip(self, int_client):
+        """S3 test blocks requests to private/internal IPs via endpoint_url (SSRF protection)."""
+        payload = {
+            "integration_type": "S3",
+            "config": {"bucket": "my-bucket", "endpoint_url": "http://127.0.0.1/s3"},
+            "credentials": {"access_key_id": "AKIA", "secret_access_key": "secret"},
+        }
+        resp = int_client.post("/api/integrations/test", json=payload)
+        assert resp.status_code == 200
+        data = resp.json()
+        assert data["success"] is False
+        assert "internal" in data["message"].lower() or "private" in data["message"].lower()
+
+    def test_test_s3_blocks_localhost(self, int_client):
+        """S3 test blocks requests to localhost via endpoint_url."""
+        payload = {
+            "integration_type": "S3",
+            "config": {"bucket": "my-bucket", "endpoint_url": "http://localhost/s3"},
+            "credentials": {"access_key_id": "AKIA", "secret_access_key": "secret"},
+        }
+        resp = int_client.post("/api/integrations/test", json=payload)
+        assert resp.status_code == 200
+        data = resp.json()
+        assert data["success"] is False
+        assert "internal" in data["message"].lower() or "private" in data["message"].lower()
+
+    def test_test_s3_blocks_file_scheme(self, int_client):
+        """S3 test blocks file:// scheme via endpoint_url."""
+        payload = {
+            "integration_type": "S3",
+            "config": {"bucket": "my-bucket", "endpoint_url": "file:///etc/passwd"},
+            "credentials": {"access_key_id": "AKIA", "secret_access_key": "secret"},
+        }
+        resp = int_client.post("/api/integrations/test", json=payload)
+        assert resp.status_code == 200
+        data = resp.json()
+        assert data["success"] is False
+        assert "scheme" in data["message"].lower()
+
     def test_test_webdav_missing_url(self, int_client):
         """WebDAV test with missing URL returns failure."""
         payload = {