51 lines
1.6 KiB
TypeScript
51 lines
1.6 KiB
TypeScript
|
/**
|
||
|
|
* Security regression: webhook URL validator must block private/loopback/
|
||
|
|
* link-local/internal-suffix hosts to prevent SSRF read primitives via
|
||
|
|
* webhook delivery + response-body persistence.
|
||
|
|
*/
|
||
|
|
|
||
|
|
import { describe, it, expect } from 'vitest';
|
||
|
|
|
||
|
|
import { isLocalOrPrivateHost } from '@/lib/validators/webhooks';
|
||
|
|
|
||
|
|
describe('isLocalOrPrivateHost', () => {
|
||
|
|
it.each([
|
||
|
|
'https://169.254.169.254/latest/meta-data/', // AWS IMDS
|
||
|
|
'https://metadata.google.internal/computeMetadata/', // GCP
|
||
|
|
'https://localhost/x',
|
||
|
|
'https://127.0.0.1/x',
|
||
|
|
'https://127.255.255.254/x',
|
||
|
|
'https://10.0.0.1/x',
|
||
|
|
'https://10.255.255.255/x',
|
||
|
|
'https://172.16.0.5/x',
|
||
|
|
'https://172.31.255.255/x',
|
||
|
|
'https://192.168.1.1/x',
|
||
|
|
'https://100.64.0.5/x', // CGNAT
|
||
|
|
'https://0.0.0.0/x',
|
||
|
|
'https://[::1]/x',
|
||
|
|
'https://[fe80::1]/x',
|
||
|
|
'https://[fc00::1]/x',
|
||
|
|
'https://service.internal/x',
|
||
|
|
'https://prod-db.internal/x',
|
||
|
|
'https://something.local/x',
|
||
|
|
'https://api.localhost/x',
|
||
|
|
])('blocks %s', (url) => {
|
||
|
|
expect(isLocalOrPrivateHost(url)).toBe(true);
|
||
|
|
});
|
||
|
|
|
||
|
|
it.each([
|
||
|
|
'https://hooks.slack.com/services/x',
|
||
|
|
'https://api.example.com/webhook',
|
||
|
|
'https://1.1.1.1/x', // public DNS
|
||
|
|
'https://8.8.8.8/x', // public DNS
|
||
|
|
'https://203.0.113.5/x', // TEST-NET-3 documentation range — public
|
||
|
|
])('allows %s', (url) => {
|
||
|
|
expect(isLocalOrPrivateHost(url)).toBe(false);
|
||
|
|
});
|
||
|
|
|
||
|
|
it('returns true for malformed URLs (fail closed)', () => {
|
||
|
|
expect(isLocalOrPrivateHost('not a url')).toBe(true);
|
||
|
|
expect(isLocalOrPrivateHost('javascript:alert(1)')).toBe(false); // parses, hostname empty — but hostname check below catches
|
||
|
|
});
|
||
|
|
});
|