Backport fix: [OCISDEV-879] disalow the 3xx redirectst for the ocm http client

[2403905]

Backport fix: [OCISDEV-879] disalow the 3xx redirectst for the ocm http client

[kw-security]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[Copilot]

Pull request overview

This PR backports a security hardening fix for OCM by (1) preventing the OCM WebDAV HTTP client from following 3xx redirects and (2) validating that inbound OCM protocol URIs use an allowed scheme (https by default, optional http via config) before downstream code consumes them.

Changes:

• Add a custom RoundTripper to tag outbound WebDAV requests so gowebdav inhibits following redirects.
• Add URI scheme/host validation for OCM share-create protocols, with a new allow_http config toggle.
• Add unit tests for URI scheme validation and a changelog entry.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
pkg/ocm/storage/received/ocm.go	Wrap WebDAV transport to inhibit redirects; introduce a custom HTTP transport configuration.
internal/http/services/ocmd/shares.go	Validate URI schemes for protocol fields during CreateShare request parsing; wire allow_http into handler.
internal/http/services/ocmd/scheme_test.go	Add unit tests for validateURIScheme.
internal/http/services/ocmd/protocols.go	Implement validateURIScheme helper for https/http-only URI validation.
internal/http/services/ocmd/ocm.go	Add allow_http configuration field.
changelog/unreleased/fix-ocm-validation.md	Document the fix in the changelog.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.