fix(security): SSRF log injection and folder permissions

backend/gestion/services/geo_services.go

@@ -274,13 +274,25 @@ func CalculateETAWithTomTom(from, to Coordinates) (int, float64, error) {
 	}
 
 	// API TomTom Routing: Calculate Route avec trafic
-	apiURL := fmt.Sprintf(
-		"https://api.tomtom.com/routing/1/calculateRoute/%f,%f:%f,%f/json?key=%s&traffic=true&travelMode=car",
-		from.Latitude, from.Longitude, to.Latitude, to.Longitude, apiKey,
-	)
+	u := &url.URL{
+		Scheme: "https",
+		Host:   "api.tomtom.com",
+		Path:   fmt.Sprintf("/routing/1/calculateRoute/%f,%f:%f,%f/json", from.Latitude, from.Longitude, to.Latitude, to.Longitude),
+	}
+	q := url.Values{}
+	q.Set("key", apiKey)
+	q.Set("traffic", "true")
+	q.Set("travelMode", "car")
+	u.RawQuery = q.Encode()
+
+	req, err := http.NewRequest(http.MethodGet, u.String(), nil)
+	if err != nil {
+		distance := CalculateDistance(from, to)
+		return CalculateETA(distance), distance, nil
+	}
 
 	client := &http.Client{Timeout: 8 * time.Second}
-	resp, err := client.Get(apiURL)
+	resp, err := client.Do(req)
 	if err != nil {
 		// Fallback sur calcul local en cas d'erreur réseau
 		distance := CalculateDistance(from, to)

backend/gestion/services/tomtom.go

@@ -11,6 +11,7 @@ import (
 	"io"
 	"log"
 	"net/http"
+	"net/url"
 	"os"
 	"time"
 )
@@ -21,13 +22,24 @@ func GetETAWithTraffic(from, to Coordinates) (etaMinutes int, distanceKm float64
 		return 0, 0, fmt.Errorf("TOMTOM_API_KEY non configurée")
 	}
 
-	url := fmt.Sprintf(
-		"https://api.tomtom.com/routing/1/calculateRoute/%f,%f:%f,%f/json?key=%s&traffic=true&travelMode=car",
-		from.Latitude, from.Longitude, to.Latitude, to.Longitude, apiKey,
-	)
+	u := &url.URL{
+		Scheme: "https",
+		Host:   "api.tomtom.com",
+		Path:   fmt.Sprintf("/routing/1/calculateRoute/%f,%f:%f,%f/json", from.Latitude, from.Longitude, to.Latitude, to.Longitude),
+	}
+	q := url.Values{}
+	q.Set("key", apiKey)
+	q.Set("traffic", "true")
+	q.Set("travelMode", "car")
+	u.RawQuery = q.Encode()
+
+	req, err := http.NewRequest(http.MethodGet, u.String(), nil)
+	if err != nil {
+		return 0, 0, fmt.Errorf("erreur construction requête TomTom: %w", err)
+	}
 
 	client := &http.Client{Timeout: 10 * time.Second}
-	resp, err := client.Get(url)
+	resp, err := client.Do(req)
 	if err != nil {
 		return 0, 0, fmt.Errorf("erreur requête TomTom: %w", err)
 	}