From 97ccb365ecc8312a07f561792be4075e43c43d96 Mon Sep 17 00:00:00 2001 From: Joe Chen Date: Sat, 25 Jun 2022 20:36:05 +0800 Subject: webhook: validate against hostname instead of full URL (#7075) --- internal/db/webhook.go | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) (limited to 'internal/db') diff --git a/internal/db/webhook.go b/internal/db/webhook.go index 2cebd3fa..3e816061 100644 --- a/internal/db/webhook.go +++ b/internal/db/webhook.go @@ -11,6 +11,7 @@ import ( "encoding/hex" "fmt" "io/ioutil" + "net/url" "strings" "time" @@ -695,8 +696,13 @@ func TestWebhook(repo *Repository, event HookEventType, p api.Payloader, webhook } func (t *HookTask) deliver() { - if netutil.IsBlockedLocalHostname(t.URL, conf.Security.LocalNetworkAllowlist) { - t.ResponseContent = "Payload URL resolved to a local network address that is implicitly blocked." + payloadURL, err := url.Parse(t.URL) + if err != nil { + t.ResponseContent = fmt.Sprintf(`{"body": "Cannot parse payload URL: %v"}`, err) + return + } + if netutil.IsBlockedLocalHostname(payloadURL.Hostname(), conf.Security.LocalNetworkAllowlist) { + t.ResponseContent = `{"body": "Payload URL resolved to a local network address that is implicitly blocked."}` return } -- cgit v1.2.3