Matt
221ae5784e
Bundles the prior autonomous-session output that was sitting unstaged: - Em-dash sweep across src/ + tests/ (en-dash/em-dash to hyphen, ~2280 instances) - country-flag-icons rollout (CountryFlag component, replaces emoji glyphs that never rendered on Windows; lazy-loads the 3x2 SVG index as a single chunk after the per-subpath dynamic-import approach silently failed in webpack) - Admin IA Phase 1+2: 7-domain regroup, 41 to 38 pages, /admin/berths index, redirects (ocr to ai, reports to dashboard, invitations to users), docs/admin-ia-proposal.md - Per-template email tester (registry + endpoint + UI on Email admin page) - Cancel-document mode picker (delete-from-Documenso vs keep-for-audit) - Dashboard PDF report: 25 widgets, SVG charts, date-range picker, 11 resolvers - Customize-widgets per-region sortables at xl+ (charts/rails/feed); single flat sortable below xl when the layout stacks; per-viewport saved orders - Audit doc updates capturing each shipped item - Lint fixes: react-compiler immutability in DonutChart (reduce instead of let-reassign), set-state-in-effect disables in CountryFlag and UploadForSigning preview-bytes effect, unused 'confirm' destructures in interest contract + reservation tabs, unescaped apostrophe in test-template card copy
51 lines
1.6 KiB
TypeScript
51 lines
1.6 KiB
TypeScript
/**
|
|
* Security regression: webhook URL validator must block private/loopback/
|
|
* link-local/internal-suffix hosts to prevent SSRF read primitives via
|
|
* webhook delivery + response-body persistence.
|
|
*/
|
|
|
|
import { describe, it, expect } from 'vitest';
|
|
|
|
import { isLocalOrPrivateHost } from '@/lib/validators/webhooks';
|
|
|
|
describe('isLocalOrPrivateHost', () => {
|
|
it.each([
|
|
'https://169.254.169.254/latest/meta-data/', // AWS IMDS
|
|
'https://metadata.google.internal/computeMetadata/', // GCP
|
|
'https://localhost/x',
|
|
'https://127.0.0.1/x',
|
|
'https://127.255.255.254/x',
|
|
'https://10.0.0.1/x',
|
|
'https://10.255.255.255/x',
|
|
'https://172.16.0.5/x',
|
|
'https://172.31.255.255/x',
|
|
'https://192.168.1.1/x',
|
|
'https://100.64.0.5/x', // CGNAT
|
|
'https://0.0.0.0/x',
|
|
'https://[::1]/x',
|
|
'https://[fe80::1]/x',
|
|
'https://[fc00::1]/x',
|
|
'https://service.internal/x',
|
|
'https://prod-db.internal/x',
|
|
'https://something.local/x',
|
|
'https://api.localhost/x',
|
|
])('blocks %s', (url) => {
|
|
expect(isLocalOrPrivateHost(url)).toBe(true);
|
|
});
|
|
|
|
it.each([
|
|
'https://hooks.slack.com/services/x',
|
|
'https://api.example.com/webhook',
|
|
'https://1.1.1.1/x', // public DNS
|
|
'https://8.8.8.8/x', // public DNS
|
|
'https://203.0.113.5/x', // TEST-NET-3 documentation range - public
|
|
])('allows %s', (url) => {
|
|
expect(isLocalOrPrivateHost(url)).toBe(false);
|
|
});
|
|
|
|
it('returns true for malformed URLs (fail closed)', () => {
|
|
expect(isLocalOrPrivateHost('not a url')).toBe(true);
|
|
expect(isLocalOrPrivateHost('javascript:alert(1)')).toBe(false); // parses, hostname empty - but hostname check below catches
|
|
});
|
|
});
|