xarmian ce46b6f190 fix(webhooks): enforce SSRF guard at dial time + widen deny-list (#836) ...

The webhook SSRF guard only validated the literal URL string at parse
time, so HTTP 302 redirects and DNS rebinding both reached internal IPs
(cloud metadata, RFC1918, docker services).

Enforce the guard at connect time: the delivery client's dialer Control
callback re-checks the actual resolved IP before the socket connects
(closing the DNS-rebind TOCTOU), and CheckRedirect re-runs
ValidateWebhookURL on every hop with a redirect cap. Proxy is pinned nil
so HTTP(S)_PROXY can't bypass the dialer's check.

Widen isPrivateIP to also deny CGNAT (100.64/10), IETF protocol
assignments (192.0.0/24), benchmarking (198.18/15), Class E (240/4),
broadcast, all multicast (224/4, ff00::/8), and the TEST-NET / IPv6
documentation ranges.

Fixes BUG-1993.

Claude-Session: https://claude.ai/code/session_01BoPkYhKqMiWPYmxQigeWsA

2026-07-07 15:23:25 -04:00

..

dispatcher_test.go

fix(webhooks): enforce SSRF guard at dial time + widen deny-list (#836)

2026-07-07 15:23:25 -04:00

dispatcher.go

fix(webhooks): enforce SSRF guard at dial time + widen deny-list (#836)

2026-07-07 15:23:25 -04:00

validate_test.go

fix(webhooks): enforce SSRF guard at dial time + widen deny-list (#836)

2026-07-07 15:23:25 -04:00

validate.go

fix(webhooks): enforce SSRF guard at dial time + widen deny-list (#836)

2026-07-07 15:23:25 -04:00