Complete RC6 supply chain gates

backend/app/main.py

@@ -22,6 +22,7 @@ from app.services.runtime_reconciliation_service import RuntimeReconciliationSer
 
 logger = logging.getLogger("geointel")
 SAFE_REQUEST_ID = re.compile(r"^[A-Za-z0-9._:-]{1,128}$")
+UNSAFE_HOST = re.compile(r"[/\\@\s\x00-\x1f\x7f]")
 
 
 def _to_error_payload(
@@ -100,14 +101,39 @@ def create_app() -> FastAPI:
         request.state.request_id = request_id
         token = set_request_id(request_id)
         started_at = time.perf_counter()
+        raw_path = str(request.scope.get("path") or "")
         try:
+            host = request.headers.get("host", "")
+            content_type = request.headers.get("content-type", "").split(";", 1)[0].strip().lower()
+            if not raw_path.startswith("/") or not host or UNSAFE_HOST.search(host):
+                response = JSONResponse(
+                    status_code=400,
+                    content=_to_error_payload(
+                        "INVALID_REQUEST_TARGET",
+                        "The request target or Host header is invalid",
+                        request_id=request_id,
+                    ),
+                )
+                response.headers["x-request-id"] = request_id
+                return response
+            if content_type == "application/x-www-form-urlencoded":
+                response = JSONResponse(
+                    status_code=415,
+                    content=_to_error_payload(
+                        "UNSUPPORTED_CONTENT_TYPE",
+                        "URL-encoded form bodies are not supported",
+                        request_id=request_id,
+                    ),
+                )
+                response.headers["x-request-id"] = request_id
+                return response
             response = await call_next(request)
             response.headers["x-request-id"] = request_id
             logger.info(
                 "request_complete request_id=%s method=%s path=%s status=%s duration_ms=%.1f",
                 request_id,
                 request.method,
-                request.url.path,
+                raw_path,
                 response.status_code,
                 (time.perf_counter() - started_at) * 1000,
             )
@@ -165,7 +191,7 @@ def create_app() -> FastAPI:
             "Unhandled request error request_id=%s method=%s path=%s",
             request.state.request_id,
             request.method,
-            request.url.path,
+            str(request.scope.get("path") or ""),
         )
         return JSONResponse(
             status_code=500,