Oliver Kieselbach c59e65ee0a fix(backend): webhook SSRF gate moves onto the connection ...

SsrfGuard.ValidateDestinationAsync resolved the webhook host and checked
it, then HttpClient resolved it again for the POST, so a DNS-rebinding
host could pass the check and be connected to an internal address.

The webhook client's SocketsHttpHandler now connects through
SsrfGuard.ConnectToPublicAddress: it resolves once per connection,
refuses the connection if any address is blocked, enforces HTTPS and
connects the socket only to the checked addresses; TLS still runs against
the request host. The pre-flight check is removed, the registration moves
to AddWebhookNotificationHttpClient so a test can prove the wiring, the
notification retry policy no longer retries a refused destination, and
the test endpoint reports the refusal with the same message as before.

IsBlockedAddress follows the same model as the MCP server: all IANA
special-purpose space, IPv6 only 2000::/3, zone ids and IPv4-mapped
addresses refused (IPNetwork.Contains judges a mapped address by its
IPv4 form, so those are refused first).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

2026-09-27 12:36:06 +02:00

..

Agent

feat(agent): Delivery Optimization geo endpoint as last-resort geolocation provider

2026-09-25 17:08:56 +02:00

Backend

fix(backend): webhook SSRF gate moves onto the connection

2026-09-27 12:36:06 +02:00

McpServer

fix(mcp): CIMD fetch checks the address inside the socket's own DNS lookup

2026-09-27 12:35:56 +02:00

Shared

fix(backend): admin configuration is written only in its changed columns; PATCH global/config replaces the full-model PUT (D-285)

2026-09-25 13:51:53 +02:00

Web

fix(web): service-principal member form names both uses — automation (access_as_application) and an app sending its users' tokens (delegated access_as_user, users read-only)

2026-09-25 14:51:52 +02:00