pn-new-crm/tests/unit/webhook-ssrf-validator.test.ts

/**
 * Security regression: webhook URL validator must block private/loopback/
 * link-local/internal-suffix hosts to prevent SSRF read primitives via
 * webhook delivery + response-body persistence.
 */

import { describe, it, expect } from 'vitest';

import { isLocalOrPrivateHost } from '@/lib/validators/webhooks';

describe('isLocalOrPrivateHost', () => {
  it.each([
    'https://169.254.169.254/latest/meta-data/', // AWS IMDS
    'https://metadata.google.internal/computeMetadata/', // GCP
    'https://localhost/x',
    'https://127.0.0.1/x',
    'https://127.255.255.254/x',
    'https://10.0.0.1/x',
    'https://10.255.255.255/x',
    'https://172.16.0.5/x',
    'https://172.31.255.255/x',
    'https://192.168.1.1/x',
    'https://100.64.0.5/x', // CGNAT
    'https://0.0.0.0/x',
    'https://[::1]/x',
    'https://[fe80::1]/x',
    'https://[fc00::1]/x',
    'https://service.internal/x',
    'https://prod-db.internal/x',
    'https://something.local/x',
    'https://api.localhost/x',
  ])('blocks %s', (url) => {
    expect(isLocalOrPrivateHost(url)).toBe(true);
  });

  it.each([
    'https://hooks.slack.com/services/x',
    'https://api.example.com/webhook',
    'https://1.1.1.1/x', // public DNS
    'https://8.8.8.8/x', // public DNS
    'https://203.0.113.5/x', // TEST-NET-3 documentation range - public
  ])('allows %s', (url) => {
    expect(isLocalOrPrivateHost(url)).toBe(false);
  });

  it('returns true for malformed URLs (fail closed)', () => {
    expect(isLocalOrPrivateHost('not a url')).toBe(true);
    expect(isLocalOrPrivateHost('javascript:alert(1)')).toBe(false); // parses, hostname empty - but hostname check below catches
  });
});