Zhengchao An 183c1d8cb4 fix(targets): disable HTTP redirects on webhook delivery client (#4420) ...

fix(targets): disable HTTP redirects on webhook delivery client (backlog#974)

The webhook reqwest client used the default redirect policy (follows up to
10 redirects). Even though the configured endpoint is validated against
outbound-egress rules, a malicious or compromised endpoint could return a
3xx response to bounce the outbound request to an internal address (e.g. the
cloud metadata service at 169.254.169.254), bypassing that validation (SSRF).

- Set `.redirect(reqwest::redirect::Policy::none())` on the delivery client
  so redirects are never followed.
- Treat a 3xx response as a delivery failure (error carries the status code)
  instead of silently succeeding.
- Add a regression test that stands up a loopback server returning a 302 to
  an internal metadata address and asserts the client surfaces the 3xx rather
  than following it.

Refs: https://github.com/rustfs/backlog/issues/974

2026-07-08 16:05:37 +08:00

..

benches

feat(admin): add audit target APIs and harden target source handling (#2350)

2026-04-04 09:07:22 +08:00

src

fix(targets): disable HTTP redirects on webhook delivery client (#4420)

2026-07-08 16:05:37 +08:00

tests

refactor(s3): consolidate semantic boundaries and remove s3-common (#3012)

2026-05-19 12:50:25 +00:00

AGENTS.md

refactor(targets): unify queue/connectivity handling and coverage (#2953)

2026-05-14 04:31:23 +00:00

Cargo.toml

fix(security): add shared outbound egress guard (#3567)

2026-06-18 15:30:09 +08:00