fix(filter): enforce real IP/CIDR SSRF checks on webhook targets #243

Merged

KofTwentyTwo merged 1 commits from story/m6-webhook-ssrf into dev

2026-07-30 18:10:07 +00:00

Author	SHA1	Message	Date
James Maes	fb69e335ea	fix(filter): enforce real IP/CIDR SSRF checks on webhook targets Replace the substring blocklist in pass 6 with parsed IP-literal range checks and add a dispatch-time DNS-resolution check so hostnames that resolve into private/metadata ranges are rejected before connecting. Refs #203	2026-07-30 13:03:12 -05:00

Author

SHA1

Message

Date

James Maes

fb69e335ea

fix(filter): enforce real IP/CIDR SSRF checks on webhook targets

Replace the substring blocklist in pass 6 with parsed IP-literal range
checks and add a dispatch-time DNS-resolution check so hostnames that
resolve into private/metadata ranges are rejected before connecting.

Refs #203

2026-07-30 13:03:12 -05:00