Rekor affected by Server-Side Request Forgery (SSRF) via provided public key URL

@@ -115,13 +115,12 @@ var searchCmd = &cobra.Command{
 			hasher := sha256.New()
 			var tee io.Reader
 			if isURL(artifactStr) {
-				/* #nosec G107 */
-				resp, err := http.Get(artifactStr)
+				r, err := util.FileOrURLReadCloser(cmd.Context(), artifactStr, nil)
 				if err != nil {
 					return nil, fmt.Errorf("error fetching '%v': %w", artifactStr, err)
 				}
-				defer resp.Body.Close()
-				tee = io.TeeReader(resp.Body, hasher)
+				defer r.Close()
+				tee = io.TeeReader(r, hasher)
 			} else {
 				file, err := os.Open(filepath.Clean(artifactStr))
 				if err != nil {
@@ -167,7 +166,16 @@ var searchCmd = &cobra.Command{
 			splitPubKeyString := strings.Split(publicKeyStr, ",")
 			if len(splitPubKeyString) == 1 {
 				if isURL(splitPubKeyString[0]) {
-					params.Query.PublicKey.URL = strfmt.URI(splitPubKeyString[0])
+					r, err := util.FileOrURLReadCloser(cmd.Context(), splitPubKeyString[0], nil)
+					if err != nil {
+						return nil, fmt.Errorf("error fetching '%v': %w", splitPubKeyString[0], err)
+					}
+					defer r.Close()
+					c, err := io.ReadAll(r)
+					if err != nil {
+						return nil, fmt.Errorf("error reading public key from '%v': %w", splitPubKeyString[0], err)
+					}
+					params.Query.PublicKey.Content = c
 				} else {
 					keyBytes, err := os.ReadFile(filepath.Clean(splitPubKeyString[0]))
 					if err != nil {

@@ -140,7 +140,6 @@ paths:
       summary: Creates an entry in the transparency log
       description: >
         Creates an entry in the transparency log for a detached signature, public key, and content.
-        Items can be included in the request or fetched by the server when URLs are specified.
       operationId: createLogEntry
       tags:
         - entries
@@ -496,9 +495,6 @@ definitions:
           content:
             type: string
             format: byte
-          url:
-            type: string
-            format: uri
         required:
           - "format"
       hash:

@@ -16,6 +16,7 @@
 package api
 
 import (
+	"bytes"
 	"context"
 	"crypto/sha256"
 	"encoding/hex"
@@ -62,11 +63,7 @@ func SearchIndexHandler(params index.SearchIndexParams) middleware.Responder {
 		if err != nil {
 			return handleRekorAPIError(params, http.StatusBadRequest, err, unsupportedPKIFormat)
 		}
-		keyReader, err := util.FileOrURLReadCloser(httpReqCtx, params.Query.PublicKey.URL.String(), params.Query.PublicKey.Content)
-		if err != nil {
-			return handleRekorAPIError(params, http.StatusBadRequest, err, malformedPublicKey)
-		}
-		defer keyReader.Close()
+		keyReader := bytes.NewReader(params.Query.PublicKey.Content)
 
 		key, err := af.NewPublicKey(keyReader)
 		if err != nil {

@@ -84,7 +84,7 @@ type ClientService interface {
 /*
 CreateLogEntry creates an entry in the transparency log
 
-Creates an entry in the transparency log for a detached signature, public key, and content. Items can be included in the request or fetched by the server when URLs are specified.
+Creates an entry in the transparency log for a detached signature, public key, and content.
 */
 func (a *Client) CreateLogEntry(params *CreateLogEntryParams, opts ...ClientOption) (*CreateLogEntryCreated, error) {
 	// NOTE: parameters are not validated before sending

@@ -238,10 +238,6 @@ type SearchIndexPublicKey struct {
 	// Required: true
 	// Enum: ["pgp","x509","minisign","ssh","tuf"]
 	Format *string `json:"format"`
-
-	// url
-	// Format: uri
-	URL strfmt.URI `json:"url,omitempty"`
 }
 
 // Validate validates this search index public key
@@ -252,10 +248,6 @@ func (m *SearchIndexPublicKey) Validate(formats strfmt.Registry) error {
 		res = append(res, err)
 	}
 
-	if err := m.validateURL(formats); err != nil {
-		res = append(res, err)
-	}
-
 	if len(res) > 0 {
 		return errors.CompositeValidationError(res...)
 	}
@@ -314,18 +306,6 @@ func (m *SearchIndexPublicKey) validateFormat(formats strfmt.Registry) error {
 	return nil
 }
 
-func (m *SearchIndexPublicKey) validateURL(formats strfmt.Registry) error {
-	if swag.IsZero(m.URL) { // not required
-		return nil
-	}
-
-	if err := validate.FormatOf("publicKey"+"."+"url", "body", "uri", m.URL.String(), formats); err != nil {
-		return err
-	}
-
-	return nil
-}
-
 // ContextValidate validates this search index public key based on context it is used
 func (m *SearchIndexPublicKey) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
 	return nil

@@ -144,7 +144,7 @@ func init() {
         }
       },
       "post": {
-        "description": "Creates an entry in the transparency log for a detached signature, public key, and content. Items can be included in the request or fetched by the server when URLs are specified.\n",
+        "description": "Creates an entry in the transparency log for a detached signature, public key, and content.\n",
         "tags": [
           "entries"
         ],
@@ -589,10 +589,6 @@ func init() {
                 "ssh",
                 "tuf"
               ]
-            },
-            "url": {
-              "type": "string",
-              "format": "uri"
             }
           }
         }
@@ -1074,7 +1070,7 @@ func init() {
         }
       },
       "post": {
-        "description": "Creates an entry in the transparency log for a detached signature, public key, and content. Items can be included in the request or fetched by the server when URLs are specified.\n",
+        "description": "Creates an entry in the transparency log for a detached signature, public key, and content.\n",
         "tags": [
           "entries"
         ],
@@ -2719,10 +2715,6 @@ func init() {
                 "ssh",
                 "tuf"
               ]
-            },
-            "url": {
-              "type": "string",
-              "format": "uri"
             }
           }
         }
@@ -2747,10 +2739,6 @@ func init() {
             "ssh",
             "tuf"
           ]
-        },
-        "url": {
-          "type": "string",
-          "format": "uri"
         }
       }
     },

@@ -50,7 +50,7 @@ func NewCreateLogEntry(ctx *middleware.Context, handler CreateLogEntryHandler) *
 
 # Creates an entry in the transparency log
 
-Creates an entry in the transparency log for a detached signature, public key, and content. Items can be included in the request or fetched by the server when URLs are specified.
+Creates an entry in the transparency log for a detached signature, public key, and content.
 */
 type CreateLogEntry struct {
 	Context *middleware.Context

@@ -21,14 +21,18 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	"time"
 )
 
-// FileOrURLReadCloser Note: caller is responsible for closing ReadCloser returned from method!
+// FileOrURLReadCloser reads content either from a URL or a byte slice
+// Note: Caller is responsible for closing the returned ReadCloser
+// Note: This must never be called from any server codepath to prevent SSRF
 func FileOrURLReadCloser(ctx context.Context, url string, content []byte) (io.ReadCloser, error) {
 	var dataReader io.ReadCloser
 	if url != "" {
-		//TODO: set timeout here, SSL settings?
-		client := &http.Client{}
+		client := &http.Client{
+			Timeout: 30 * time.Second,
+		}
 		req, err := http.NewRequestWithContext(ctx, "GET", url, nil)
 		if err != nil {
 			return nil, err