fix(providers/azure): harden Synapse nil HTTP client fallback

providers/azure/services/synapse/client.go

@@ -63,10 +63,11 @@ func NewClient(cred azcore.TokenCredential, subscriptionID, region string) *Syna
 }
 
 // NewClientWithHTTP creates a new Azure Synapse client with a custom HTTP client (for testing).
-// If httpClient is nil, http.DefaultClient is used.
+// When httpClient is nil, the SSRF-hardened httpclient.New() is used so the nil
+// fallback also blocks IMDS connections.
 func NewClientWithHTTP(cred azcore.TokenCredential, subscriptionID, region string, httpClient HTTPClient) *SynapseClient {
 	if httpClient == nil {
-		httpClient = http.DefaultClient
+		httpClient = httpclient.New()
 	}
 	return &SynapseClient{
 		cred:           cred,
@@ -344,7 +345,7 @@ func (c *SynapseClient) GetOfferingDetails(ctx context.Context, rec common.Recom
 		upfrontCost = 0
 		recurringCost = totalCost / (float64(termYears) * 12)
 	default:
-		// Fail loud on an unrecognised payment option rather than silently
+		// Fail loud on an unrecognized payment option rather than silently
 		// billing it as all-upfront (owner policy: no silent fallbacks on
 		// money-affecting fields).
 		return nil, fmt.Errorf("unsupported payment option for Azure Synapse offering details: %q", rec.PaymentOption)

providers/azure/services/synapse/client_test.go

@@ -852,3 +852,24 @@ func TestGetOfferingDetails_noReservationPrice(t *testing.T) {
 // helper's contract is now exercised in providers/azure/services/internal/reservations
 // package tests; the synapse-side coverage is via the executor-level
 // PurchaseCommitment tests above.
+
+// ---- nil HTTP client fallback ----------------------------------------------
+
+// TestNewClientWithHTTP_NilFallbackIsHardened is a regression test for the
+// codebase-review finding SEC-03 (issue #1143): when httpClient is nil, the
+// httpClient falls back to httpclient.New() (SSRF-hardened), not
+// http.DefaultClient, so the fallback also rejects IMDS connections.
+func TestNewClientWithHTTP_NilFallbackIsHardened(t *testing.T) {
+	c := NewClientWithHTTP(nil, "sub-123", "eastus", nil)
+	require.NotNil(t, c.httpClient)
+	require.NotEqual(t, http.DefaultClient, c.httpClient,
+		"nil fallback must never be http.DefaultClient")
+	req, err := http.NewRequestWithContext(context.Background(), http.MethodGet, "http://169.254.169.254/metadata/instance", nil)
+	require.NoError(t, err)
+	resp, err := c.httpClient.Do(req)
+	if resp != nil {
+		defer resp.Body.Close()
+	}
+	require.Error(t, err, "nil-fallback client must reject IMDS connections")
+	assert.Contains(t, err.Error(), "blocked")
+}