greptile review fixes

backend/src/ee/services/audit-log-stream/custom/custom-provider-schemas.ts

@@ -1,3 +1,4 @@
+import RE2 from "re2";
 import { z } from "zod";
 
 import { LogProvider } from "../audit-log-stream-enums";
@@ -7,8 +8,14 @@ export const CustomProviderCredentialsSchema = z.object({
   url: z.string().url().trim().min(1).max(255),
   headers: z
     .object({
-      key: z.string().min(1),
-      value: z.string().min(1)
+      key: z
+        .string()
+        .min(1)
+        .refine((val) => new RE2(/^[^\n\r]+$/).test(val), "Header keys cannot contain newlines or carriage returns"),
+      value: z
+        .string()
+        .min(1)
+        .refine((val) => new RE2(/^[^\n\r]+$/).test(val), "Header values cannot contain newlines or carriage returns")
     })
     .array()
 });

backend/src/ee/services/audit-log-stream/splunk/splunk-provider-factory.ts

@@ -14,7 +14,7 @@ function createPayload(event: Record<string, unknown>) {
 
   return {
     time: Math.floor(Date.now() / 1000),
-    host: new URL(appCfg.SITE_URL || "http://infisical").host,
+    ...(appCfg.SITE_URL && { host: new URL(appCfg.SITE_URL).host }),
     source: "infisical",
     sourcetype: "_json",
     event
@@ -29,7 +29,7 @@ async function createSplunkUrl(hostname: string) {
     throw new BadRequestError({ message: `Invalid Splunk hostname provided: ${(error as Error).message}` });
   }
 
-  await blockLocalAndPrivateIpAddresses(`https://${hostname}`);
+  await blockLocalAndPrivateIpAddresses(`https://${parsedHostname}`);
 
   return `https://${parsedHostname}:8088/services/collector/event`;
 }