Nick Szaunig 79010a926b fix(backend): close two SSRF bypasses in webhook URL validation ...

1. The URL guard only classified IP-literal hostnames; any plain domain
   name (the common case) skipped validation entirely. Hostnames are now
   resolved via DNS and every returned address is checked against the
   same private/loopback/link-local ranges (net.BlockList), so an
   attacker-controlled domain pointed at an internal IP is rejected too.
2. fetch() follows redirects by default, so a registered public URL could
   302 to an internal target at delivery time. Delivery now uses
   redirect: 'manual' so such a redirect is never followed.

2026-08-23 11:08:40 +02:00

..

dto

feat(backend): Webhooks mit HMAC-signierter Auslieferung (Modul 28)

2026-08-23 06:56:56 +02:00

webhook-events.ts

feat(backend): Webhooks mit HMAC-signierter Auslieferung (Modul 28)

2026-08-23 06:56:56 +02:00

webhook-url-guard.spec.ts

fix(backend): close two SSRF bypasses in webhook URL validation

2026-08-23 11:08:40 +02:00

webhook-url-guard.ts

fix(backend): close two SSRF bypasses in webhook URL validation

2026-08-23 11:08:40 +02:00

webhooks.controller.ts

fix(backend): DELETE /webhooks/:id returns 204 No Content

2026-08-23 06:58:13 +02:00

webhooks.module.ts

feat(backend): Webhooks mit HMAC-signierter Auslieferung (Modul 28)

2026-08-23 06:56:56 +02:00

webhooks.service.spec.ts

fix(backend): close two SSRF bypasses in webhook URL validation

2026-08-23 11:08:40 +02:00

webhooks.service.ts

fix(backend): close two SSRF bypasses in webhook URL validation

2026-08-23 11:08:40 +02:00