Files
OmniRoute/tests/unit
Diego Rodrigues de Sa e Souza 36932b62a7 fix(api): harden private webhook opt-in against cloud-metadata SSRF (#3269) (#3281)
Follow-up to the #3269 private-webhook opt-in. With the opt-in on, the private-host
check was bypassed entirely, leaving cloud-metadata endpoints (169.254.169.254,
metadata.google.internal, 100.100.100.200, link-local 169.254.0.0/16) reachable — the
classic SSRF -> IAM-credential pivot — and the webhook test endpoint returned the
upstream body, making it a content-exfiltration primitive against internal services.

- outboundUrlGuard: add isCloudMetadataHost(); parseAndValidateWebhookUrl blocks those
  hosts UNCONDITIONALLY, even when private targets are opted in.
- webhooks/[id]/test: redact responseBody for private targets (status + latency only).

Regression test: tests/unit/webhook-metadata-guard-3269.test.ts (RED before, GREEN after);
existing webhook SSRF/opt-in suites stay green (34/34).
2026-06-06 03:08:16 -03:00
..
2026-05-23 01:46:59 -03:00
2026-05-26 23:51:47 -03:00
2026-05-29 12:44:29 -03:00
2026-05-21 01:29:12 -03:00
2026-05-26 23:51:47 -03:00
2026-05-29 12:44:29 -03:00
2026-05-23 01:46:59 -03:00
2026-05-26 23:51:47 -03:00
2026-04-19 19:50:30 -03:00
2026-05-29 12:44:29 -03:00
2026-05-29 12:44:29 -03:00
2026-05-26 23:51:47 -03:00
2026-05-26 23:51:47 -03:00
2026-05-26 23:51:47 -03:00
2026-05-29 12:44:29 -03:00
2026-05-26 23:51:47 -03:00
2026-05-26 23:51:47 -03:00
2026-05-29 12:44:29 -03:00
2026-05-21 01:29:12 -03:00
2026-05-24 18:05:58 -03:00
2026-05-26 23:51:47 -03:00
2026-05-26 23:51:47 -03:00
2026-05-29 12:44:29 -03:00
2026-05-29 12:44:29 -03:00
2026-05-26 23:51:47 -03:00
2026-05-24 18:05:58 -03:00
2026-05-26 23:51:47 -03:00
2026-05-29 12:44:29 -03:00
2026-05-26 23:51:47 -03:00
2026-05-10 00:55:06 -03:00
2026-05-29 19:54:00 -03:00
2026-05-26 23:51:47 -03:00
2026-05-29 12:44:29 -03:00
2026-05-29 12:44:29 -03:00
2026-05-21 01:29:12 -03:00
2026-04-30 01:27:03 -03:00
2026-04-30 01:27:03 -03:00
2026-05-26 23:51:47 -03:00
2026-05-29 12:44:29 -03:00
2026-05-10 00:55:06 -03:00
2026-05-26 23:51:47 -03:00
2026-04-30 14:08:50 -03:00
2026-05-29 12:44:29 -03:00
2026-05-26 23:51:47 -03:00
2026-05-26 23:51:47 -03:00
2026-05-26 23:51:47 -03:00
2026-05-29 19:54:00 -03:00
2026-05-23 01:46:59 -03:00
2026-05-26 23:51:47 -03:00
2026-04-30 01:27:03 -03:00
2026-04-30 01:27:03 -03:00
2026-05-26 23:51:47 -03:00
2026-05-23 01:46:59 -03:00
2026-05-23 01:46:59 -03:00
2026-05-23 01:46:59 -03:00
2026-05-29 19:54:00 -03:00
2026-04-28 10:03:39 -03:00
2026-05-29 12:44:29 -03:00
2026-05-24 18:05:58 -03:00
2026-05-24 18:05:58 -03:00
2026-05-10 00:55:06 -03:00
2026-04-28 20:46:25 -03:00
2026-05-29 12:44:29 -03:00
2026-05-29 12:44:29 -03:00
2026-05-23 01:46:59 -03:00
2026-06-04 20:05:38 -03:00
2026-05-26 23:51:47 -03:00
2026-05-21 01:29:12 -03:00
2026-05-26 23:51:47 -03:00
2026-05-26 23:51:47 -03:00
2026-06-04 20:05:38 -03:00
2026-05-29 12:44:29 -03:00
2026-05-26 23:51:47 -03:00
2026-05-24 18:05:58 -03:00
2026-05-26 23:51:47 -03:00