Route the platform's own SPARQL SERVICE through the egress proxy (imports, PATCH)

[namedgraph]

Closes the last variant of the SERVICE SSRF hole: the platform's own in-JVM SPARQL. Two HTTP tests plus the fix.

The hole

SERVICE is executed by whoever runs the query. The egress proxy (#387) fronts the triplestores, so SERVICE in a query to /sparql is covered. But PATCH updates and import mappings run in the platform's own JVM — PATCH on the document's graph in memory, imports over each row — so their SERVICE calls don't pass through that proxy. A writer could put SERVICE <http://fuseki-admin:3030/ds/> in a PATCH or an import mapping and copy the admin store's agents and authorizations into a document they can read. Reproduced on a live stack whose triplestores were already behind the egress proxy: a PATCH copied an admin graph name into the patched document.

Tests (committed first)

• http-tests/document-hierarchy/PATCH-service-internal.sh — PATCH with SERVICE SILENT <fuseki-admin> in its WHERE; fails if the leak triple lands in the document.
• http-tests/imports/import-rdf-service-internal.sh + rdf-service-internal.rq — an import whose CONSTRUCT does the same.

Both use SERVICE SILENT, so they check the document for data, not a status code.

Fix

Application.configureServiceExecution sets, on the global ARQ context (which the in-JVM query/update execution reads):

• route — Jena's httpQueryClient, an HttpClient whose ProxySelector sends every SERVICE request through the egress proxy (EGRESS_PROXY, default egress:3128). Public federation keeps working; internal addresses are refused, redirect hops and DNS answers included; ProxySelector.of() covers localhost too.
• refuse — when no proxy is configured, httpServiceAllowed=false, so SERVICE is disabled rather than left open.
• unrestricted — when ALLOW_INTERNAL_URLS is set, as it already turns off the rest of the SSRF protection.

Scoped to SERVICE alone: the platform's own SPARQL calls to its stores use their own HTTP clients. EGRESS_PROXY reaches the JVM as a system property via CATALINA_OPTS, the pattern the other infrastructure settings use, and linkeddatahub now depends_on: egress.

Federation still works. The shipped stack defaults EGRESS_PROXY=egress:3128, so SERVICE is proxied, not forbidden — public endpoints answer, only internal ones are refused.

Verified

• On an in-memory QueryExecution (what PATCH/imports build): httpServiceAllowed=false makes SERVICE SILENT yield no triples and a non-silent SERVICE throw QueryDeniedException.
• A ProxySelector client sends the request to the proxy, which allows public and denies internal (matching the earlier linkeddatahub.com run where SERVICE to Wikidata answered and internal targets were TCP_DENIED/403).
• mvn compile clean.

The two tests fail on the current default stack (leak reproduced) and pass with this fix routing SERVICE through egress. The full HTTP suite runs in CI.

🤖 Generated with Claude Code