Nick Szaunig a0f7573af5 fix(backend): block SSRF via webhook subscription URLs
WebhooksService.create() rejected obviously private, loopback, or
link-local URLs (incl. cloud metadata 169.254.169.254 and the
decimal/octal/hex IPv4 shorthand encodings the WHATWG URL parser
normalizes) so an admin-configured webhook can no longer be used to
proxy requests into internal infrastructure. Registration-time only,
no DNS resolution (DNS-rebinding is out of scope for this check).
2026-08-23 07:05:53 +02:00
S
Description
ApiCore - Imkereidokumentationssoftware
https://apicore.encry.de/
8.4 MiB
0 Stars 1 Watchers 0 Forks
Languages
TypeScript 98.5%
JavaScript 0.8%
Python 0.3%
CSS 0.2%
PLpgSQL 0.1%